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Foreword 


The  past  three  decades  have  seen  a  substantial 
increase  in  the  number  and  dollar  amounts  of  gov- 
ernment programs  and  services,  including  large 
expenditures  of  public  moneys  to  solve  critical 
social  and  financial  problems  in  the  public,  govern- 
ment and  industry.  This  increase  has  brought  with 
it  a  demand  for  full  accountability  by  those 
entrusted  with  public  funds  and  the  responsibility 
for  properly  managing  government  programs  and 
services. 

Auditing  has  become  an  integral  element  of  govern- 
ment accountability.  This  reliance  on  auditors  has 
enhanced  the  need  for  standards  to  guide  auditors 
and  allow  others  to  rely  on  auditors'  work.  Stan- 
dards help  ensure  that  audits  are  fair,  objective, 
and  reliable  assessments  of  government 
performance. 

This  revision  of  the  standards  supersedes  the  1981 
revision,  and  becomes  effective  for  audits  starting 
January  1,  1989.  Early  application  of  the  standards 
is  permissible. 

I  want  to  personally  thank  those  who  provided  sug- 
gestions and  comments  for  improving  the  stan- 
dards, and  to  especially  thank  the  members  of  the 
Auditing  Standards  Advisory  Council  and  the  proj- 
ect team  for  their  advice  and  efforts  in  preparing 
this  revision  of  the  standards. 

dm, /).&«*& 

Charles  A.  Bowsher 
Comptroller  General 
of  the  United  States 

July  1988 
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Chapter  1 


Introduction 


Purpose 


l.   This  statement  contains  standards  for  audits  of 
government  organizations,  programs,  activities,  and 
functions,  and  of  government  funds  received  by 
contractors,  nonprofit  organizations,  and  other 
nongovernment  organizations.  The  standards  are  to 
be  followed  by  auditors  and  audit  organizations 
when  required  by  law,  regulation,  agreement  or 
contract,  or  policy.  The  standards  pertain  to  the 
auditor's  professional  qualifications,  the  quality  of 
audit  effort,  and  the  characteristics  of  professional 
and  meaningful  audit  reports. 


Applicability 


Federal  legislation  requires  that  the  federal  inspec- 
tors general  comply  with  audit  standards  estab- 
lished by  the  Comptroller  General  for  audits  of 
federal  organizations,  programs,  activities,  and 
functions.  The  legislation  further  states  that  the 
inspectors  general  are  to  ensure  that  audit  work 
conducted  by  nonfederal  auditors  of  federal  organi- 
zations, programs,  activities,  and  functions  complies 
with  these  standards.1 


3.  Other  federal  auditors  must  also  follow  these  stan- 
dards. The  Office  of  Management  and  Budget  (omb) 
included  these  standards  as  basic  audit  criteria  for 
federal  executive  departments  and  agencies  in  omb 
Circular  A-73.2 

4.  The  Single  Audit  Act  of  1984  requires  that  these 
standards  be  followed  by  auditors  auditing  state 


!See  the  Inspector  General  Act  of  1978,  as  amended,  5  U.S.C.  App. 
(1982). 

2See  section  6  of  OMB  Circular  A-73,  "Audit  of  Federal  Opera- 
tions and  Programs." 
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and  local  governments  which  receive  federal  finan- 
cial assistance.3 

5.  Implementation  of  other  federal  policies  and  regula- 
tions, such  as  omb  Circular  A-l  10,  requires  that 
these  standards  be  followed  in  audits  of  entities 
receiving  federal  assistance.4 

6.  Auditors  conducting  government  audits  under 
agreements  or  contracts  also  may  be  required  to 
comply  with  these  audit  standards  under  the  terms 
of  the  agreement  or  contract. 

7.  The  audit  standards  set  forth  in  this  statement  are 
generally  applicable  to  and  recommended  for  use  by 
state  and  local  government  auditors  and  public 
accountants  in  audits  of  state  and  local  government 
organizations,  programs,  activities,  and  functions. 
Several  state  and  local  audit  organizations,  as  well 
as  several  nations  have  officially  adopted  these 
standards. 

8.  The  Institute  of  Internal  Auditors  and  the  American 
Evaluation  Association  (formerly  the  Evaluation 
Research  Society)  have  issued  related  standards.5 


3See  the  Single  Audit  Act  of  1984  (31  US.C.  7601-7607);  OMB  Cir- 
cular A-l  28,  "Audits  of  State  and  Local  Governments;"  and 
American  Institute  of  Certified  Public  Accountants  (AICPA)  Audit 
and  Accounting  Guide  for  Audits  of  State  and  Local  Governmen- 
tal Units.  The  act  and  circular  establish  audit  requirements  for 
state  and  local  governments  and  Indian  tribal  governments  that 
receive  federal  financial  assistance.  The  act  and  circular  require 
that  audits  of  these  entities  be  made  in  accordance  with  the  stan- 
dards in  this  statement.  The  act  also  includes       -ific  audit 
requirements  that  exceed  the  minimum  audit  requirements  set 
forth  in  the  standards  in  this  statement. 

4See  OMB  Circular  A-l  10  "Grants  and  Agreements  With  Institu- 
tions of  Higher  Education,  Hospitals,  and  Other  Nonprofit 
Organizations." 

5Standards  for  the  Professional  Practice  of  Internal  Auditing,  The 
Institute  of  Internal  Auditors,  Inc.,  copyright  1978;  and  New 
Directions  for  Program  Evaluation:  Standards  for  Evaluation 
Practice,  no.  16.  San  Francisco:  Jossey-Bass,  September  1982. 
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Relationship 

toAICPA 

Standards 


9. 


10. 


11 


The  aicpa  has  issued  standards  that  are  applicable 
to  and  generally  accepted  for  audits  conducted  to 
express  opinions  on  the  fairness  with  which  an 
organization's  financial  statements  present  the 
financial  position,  results  of  operations,  and  cash 
flows  or  changes  in  financial  position/' 

The  aicpa  standards  for  field  work  and  reporting 
have  been  incorporated  into  this  statement  for 
financial  audits.  As  additional  statements  on  audit- 
ing standards  are  issued  by  the  aicpa,  they  will  be 
adopted  and  incorporated  into  these  standards 
unless  gao  excludes  them  by  formal  announcement. 

gao  has  established  a  formal  system  for  issuing  gov- 
ernment auditing  standards  and  related  interpreta- 
tions and  guidance  to  the  audit  community. 


Accountability 


12.  Our  system  of  government  today  rests  on  an  elabo- 
rate structure  of  interlocking  relationships  among 
all  levels  of  government  for  managing  public  pro- 
grams. Officials  and  employees  who  manage  these 
programs  must  render  a  full  account  of  their  activi- 
ties to  the  public.  While  not  always  specified  by 
law,  this  accountability  concept  is  inherent  in  the 
governing  processes  of  this  nation. 

13.  The  requirement  for  accountability  has  caused  a 
demand  for  more  information  about  government 
programs  and  services.  Public  officials,  legislators, 
and  private  citizens  want  and  need  to  know  not 
only  whether  government  funds  are  handled  prop- 
erly and  in  compliance  with  laws  and  regulations, 


6The  standards  are  included  in  "Statements  on  Auditing  Stan- 
dards" (SAS)  issued  by  the  AICPA.  The  AICPA  Statement  on  Stan- 
dards for  Attestation  Engagements  may  apply  to  some  financial 
audits.  The  AICPA  also  issues  interpretations  and  audit  guides  to 
provide  guidance  on  the  application  of  standards.  These  interpre- 
tations and  guides  do  not  have  the  authority  of  a  standard  issued 
by  the  AICPA;  however,  auditors  may  have  to  justify  departures 
from  them  if  the  quality  of  their  work  is  questioned. 
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but  also  whether  government  organizations,  pro- 
grams, and  services  are  achieving  the  purposes  for 
which  they  were  authorized  and  funded  and 
whether  they  are  doing  so  economically  and 
efficiently. 

14.    This  statement  provides  auditing  standards  to  help 
ensure  full  accountability  and  assist  government 
officials  and  employees  in  carrying  out  their 
responsibilities.  The  audit  standards  are  more  than 
the  codification  of  current  practices.  They  include 
concepts  and  audit  areas  that  are  still  evolving  and 
are  vital  to  the  accountability  objectives  sought  in 
auditing  governments  and  their  programs  and 
services. 


Basic  Premises      15,    Tne  following  premises  underlie  these  standards 

and  were  considered  in  their  development. 

a.  The  term  "audit"  includes  both  financial  and  per- 
formance audits  as  described  in  this  statement. 

b.  Public  officials  have  the  responsibility  to  apply 
resources  efficiently,  economically,  and  effectively 
to  achieve  the  purposes  for  which  the  resources 
were  furnished.  This  responsibility  applies  to  all 
resources,  whether  entrusted  to  public  officials  by 
their  own  constituency  or  by  other  levels  of 
government. 

c.  Public  officials  are  accountable  both  to  the  public 
and  to  other  levels  and  branches  of  government  for 
the  resources  provided  to  carry  out  government 
programs  and  services.  Consequently  they  should 
provide  appropriate  reports  to  those  to  whom  they 
are  accountable. 


d.  Public  officials  are  responsible  for  establishing 
and  mamUining  an  effective  internal  control  sys- 
tem to  ensure  that  appropriate  goals  and  objectives 
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are  met;  resources  are  safeguarded;  laws  and  regu- 
lations are  followed;  and  reliable  data  are  obtained, 
maintained,  and  fairly  disclosed. 

e.  Public  officials  are  responsible  for  complying 
with  applicable  laws  and  regulations.  That  respon- 
sibility encompasses  identifying  the  requirements 
with  which  the  entity  and  the  official  must  comply 
and  implementing  systems  designed  to  achieve  com- 
pliance with  those  requirements. 

f  .  Financial  auditing  is  an  important  part  of  the 
accountability  process  since  it  provides  an  indepen- 
dent opinion  on  whether  an  entity's  financial  state- 
ments present  fairly  the  results  of  financial 
operations,  and  whether  other  financial  information 
is  presented  in  conformity  with  established  or 
stated  criteria.  Performance  auditing  is  also  an 
important  part  of  the  accountability  process 
because  it  provides  an  independent  view  on  the 
extent  to  which  government  officials  are  faithfully, 
efficiently,  and  effectively  carrying  out  their 
responsibilities. 

g.  Unless  legal  restrictions  or  ethical  considerations 
prevent  it,  auditees  or  audit  organizations  should 
make  audit  reports  available  to  the  public  and  to 
other  levels  of  government  that  have  supplied 
resources.7 

h.  Different  levels  of  government  share  common 
interests  in  many  programs.  In  many  government 
financial  assistance  programs,  the  interests  of  indi- 
vidual governments  often  cannot  be  isolated 
because  the  resources  applied  have  been  commin- 
gled. Therefore,  audits  of  financial  assistance  pro- 
grams having  common  interests  and  shared  funding 
should,  to  the  extent  practicable,  be  designed  to  sat- 
isfy the  common  accountability  interests  of  each 
contributing  government. 

7The  Single  Audit  Act  (31  U.S.C.  7502  (f))  requires  that  the  report 
on  single  audits  be  made  available  for  public  inspection. 
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i.  Cooperation  by  federal,  state,  and  local  govern- 
ments in  auditing  programs  of  common  interest  will 
minimize  duplication  of  audit  effort  and  benefit  all 
concerned,  and  is  a  practical  approach  in  auditing 
intergovernmental  operations. 

j.  Auditors  may  rely  on  the  work  of  others  to  the 
extent  feasible  once  they  satisfy  themselves  as  to 
the  other's  independence,  capability,  and  perform- 
ance by  appropriate  tests  of  the  work  or  by  other 
acceptable  methods.8 


Auditor 
Responsibility 


16.    The  comprehensive  nature  of  government  auditing 
places  on  the  audit  organization  the  responsibility 
for  ensuring  that  the  audit  is  conducted  by  person- 
nel who  collectively  have  the  necessary  skills,  that 
independence  is  maintained,  that  applicable  stan- 
dards are  followed  in  conducting  government 
audits,  and  that  the  organization  has  an  appropriate 
internal  quality  control  system  in  place,  and  partici- 
pates in  an  external  quality  control  review  program. 


Procurement 
of  Audit 
Services 


17.    While  not  an  audit  standard,  it  is  important  that  a 
sound  procurement  practice  be  followed  when  con- 
tracting for  audit  services.  Sound  contract  award 
and  approval  procedures,  including  the  monitoring 
of  contract  performance,  should  be  in  place.  The 
objectives  and  scope  of  the  audit  should  be  made 
clear.  In  addition  to  price,  other  factors  to  be  con- 
sidered include:  the  responsiveness  of  the  bidder  to 
the  request  for  proposal;  the  past  experience  of  the 
bidder;  availability  of  bidder  staff  with  professional 
qualifications  and  technical  abilities;  and  whether 
the  bidder  organization  participates  in  an  external 
quality  control  review  program.9 

*See  chapter  3,  paragraph  37,  for  guidance  to  follow  in  relying  on 
the  work  of  others. 

See  How  to  Avoid  a  Substandard  Audit:  Suggestions  for  Procur- 
—  an  Audit,  National  Intergovernmental  Audit  Forum.  May 
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18.    The  remainder  of  this  statement  describes  types  of 
government  audits  and  prescribes  standards  for 
conducting  such  audits. 
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Purpose  l.   This  chapter  describes  the  types  of  audits  that  gov- 

*^  eminent  and  nongovernment  audit  organizations 

conduct,  and  that  government  organizations 
arrange  to  have  conducted,  of  government  organiza- 
tions, programs,  activities,  functions,  and  funds. 
This  description  is  not  intended  to  limit  or  require 
the  types  of  audits  that  may  be  conducted  or 
arranged.  In  conducting  these  types  of  audits,  audi- 
tors should  follow  the  applicable  standards 
included  and  incorporated  in  the  chapters  which 
follow. 

2.    All  audits  begin  with  objectives  and  those  objectives 
determine  the  type  of  audit  to  be  conducted  and  the 
audit  standards  to  be  followed.  The  types  of  gov- 
ernment audits,  as  defined  by  their  objectives,  are 
classified  in  this  statement  as  financial  audits  or 
performance  audits. 


Financial  Audits   3*    ^manc^  audits  include  financial  statement  and 

financial  related  audits. 

a.  Financial  statement  audits  determine  (1)  whether 
the  financial  statements  of  an  audited  entity  pre- 
sent fairly  the  financial  position,  results  of  opera- 
tions, and  cash  flows  or  changes  in  financial 
position  in  accordance  with  generally  accepted 
accounting  principles,1  and  (2)  whether  the  entity 
has  complied  with  laws  and  regulations  for  those 
transactions  and  events  that  may  have  a  material 
effect  on  the  financial  statements. 


'Three  authoritative  bodies  for  generally  accepted  accounting 
principles  are:  the  Governmental  Accounting  Standards  Board 
(GASB),  the  Financial  Accounting  Standards  Board  (FASB),  and 
the  General  Accounting  Office  (GAO).  GASB  establishes  account- 
ing principles  and  financial  reporting  standards  for  state  and  local 
government  entities.  GAO  establishes  accounting  principles  and 
financial  reporting  standards  for  the  federal  government.  FASB 
establishes  accounting  principles  for  nongovernment  entities. 
Some  state  and  local  governments  and  regulatory  bodies  also  have 
estaolished  specific  accounting  principles. 
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b.  Financial  related  audits  include  determining 
(1)  whether  financial  reports  and  related  items, 
such  as  elements,  accounts,  or  funds  are  fairly  pre- 
sented, (2)  whether  financial  information  is  pre- 
sented in  accordance  with  established  or  stated 
criteria,  and  (3)  whether  the  entity  has  adhered  to 
specific  financial  compliance  requirements.2 

4.    Financial  related  audits  may  include  audits  of  the 
following  items:3 


a.  Segments  of  financial  statements. 

b.  Financial  information  (e.g.,  statement  of  revenue 
and  expenses,  statement  of  cash  receipts  and  dis- 
bursements, statement  of  fixed  assets). 

c.  Reports  and  schedules  on  financial  matters,  such 
as  expenditures  for  specific  programs  or  services, 
budget  requests,  and  variances  between  estimated 
and  actual  financial  performance. 

d.  Contracts  (e.g.,  bid  proposals,  contract  pricing, 
amounts  billed,  amounts  due  on  termination  claims, 
compliance  with  contract  terms). 

e.  Grants. 

f .  Internal  control  systems  and  structure  over 
accounting,  financial  reporting,  and  transaction 
processing. 

g.  Computer-based  systems. 

h.  Financial  systems  (e.g.,  payroll  systems). 
i.  Fraud. 


2The  AICPA  Statement  on  Standards  for  Attestation  Engagements 
may  apply  to  some  financial  related  audits. 

3Performance  audits  may  also  be  conducted  on  these  subjects. 
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s.    The  audit  standards  included  and  incorporated  in 
chapters  3, 4,  and  5  of  this  statement  apply  to  all 
aspects  of  financial  statement  and  financial  related 
audits,  unless  otherwise  stated. 


Performance 
Audits 


6.  Performance  audits  include  economy  and  efficiency 
and  program  audits.4 

a.  Economy  and  efficiency  audits  include  determin- 
ing (1)  whether  the  entity  is  acquiring,  protecting, 
and  using  its  resources  (such  as  personnel,  prop- 
erty, and  space)  economically  and  efficiently, 

(2)  the  causes  of  inefficiencies  or  uneconomical 
practices,  and  (3)  whether  the  entity  has  complied 
with  laws  and  regulations  concerning  matters  of 
economy  and  efficiency. 

b.  Program  audits  include  determining  (1)  the 
extent  to  which  the  desired  results  or  benefits 
established  by  the  legislature  or  other  authorizing 
body  are  being  achieved,  (2)  the  effectiveness  of 
organizations,  programs,  activities,  or  functions, 
and  (3)  whether  the  entity  has  complied  with  laws 
and  regulations  applicable  to  the  program. 

7.  Economy  and  efficiency  audits  may,  for  example, 
consider  whether  the  entity: 

a.  Is  following  sound  procurement  practices. 

b.  Is  acquiring  the  appropriate  type,  quality,  and 
amount  of  resources  when  needed  at  the  lowest 
cost. 

c.  Is  properly  protecting  and  mamtaining  its 
resources. 

Performance  audits  encompass  value-for-money  audits  which 
assess  whether  government  entities  are  managed  with  regard  for 
economy  and  efficiency,  and  for  effectiveness  measurement,  and 
in  compliance  with  applicable  laws,  regulations,  and  directives. 
However,  the  objectives  in  performance  audits  are  more  compre- 
hensive than  those  in  value-for-money  audits. 
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d.  Is  avoiding  duplication  of  effort  by  employees 
and  work  that  serves  little  or  no  purpose. 

e.  Is  avoiding  idleness  and  overstaffing. 

f.  Is  using  efficient  operating  procedures. 

g.  Is  using  the  minimum  amount  of  resources  (staff, 
equipment,  and  facilities)  in  producing  or  delivering 
the  appropriate  quantity  and  quality  of  goods  or 
services  in  a  timely  manner. 

h.  Is  complying  with  requirements  of  laws  and  regu- 
lations that  could  significantly  affect  the  acquisi- 
tion, protection,  and  use  of  the  entity's  resources. 

i.  Has  an  adequate  system  for  measuring  and 
reporting  performance  on  economy  and  efficiency. 

8.    Program  audits  may,  for  example:5 

a.  Assess  whether  the  objectives  of  a  proposed, 
new,  or  ongoing  program  are  proper,  suitable,  or 
relevant. 

b.  Determine  the  extent  to  which  a  program 
achieves  a  desired  level  of  program  results. 

c.  Assess  the  effectiveness  of  the  program  and/or  of 
individual  program  components. 

d.  Identify  factors  inhibiting  satisfactory 
performance. 

e.  Determine  whether  management  has  considered 
alternatives  for  carrying  out  the  program  that 
might  yield  desired  results  more  effectively  or  at  a 
lower  cost. 


5These  audits  may  also  apply  to  services,  activities,  and  functions 
as  well  as  programs. 
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f.  Determine  whether  the  program  complements, 
duplicates,  overlaps,  or  conflicts  with  other  related 
programs. 

g.  Identify  ways  of  making  programs  work  better. 

h.  Assess  compliance  with  laws  and  regulations 
applicable  to  the  program. 

L  Assess  the  adequacy  of  management's  system  for 
measuring  and  reporting  effectiveness. 

Generally,  at  the  completion  of  a  performance  audit 
the  auditor  does  not  express  an  opinion  on  the  over- 
all level  of  performance.  Therefore  these  standards 
do  not  contemplate  that  the  auditor  will  be  called 
upon  to  give  such  an  opinion.  Rather,  the  auditor 
would  report  findings  and  conclusions  on  the  extent 
and  adequacy  of  performance,  and  on  specific 
processes,  methods,  and  internal  controls  that  can 
be  made  more  efficient  or  effective.  If  potential  for 
improvement  is  found,  the  auditor  would  recom- 
mend appropriate  corrective  actions. 

The  audit  standards  included  in  chapters  3, 6,  and  7 
of  this  statement  apply  to  all  aspects  of  economy 
and  efficiency  and  program  audits  unless  otherwise 
stated. 


Understanding 
the  Audit 
Objectives  and 
Scope 


ii.   The  importance  and  comprehensive  nature  of  gov- 
ernment auditing  places  on  government  officials 
who  authorize  or  arrange  government  audits  the 
responsibility  for  providing  audit  coverage  that  is 
broad  enough  to  help  fulfill  the  reasonable  needs  of 
potential  users  of  the  audit  report.  This  comprehen- 
sive nature  of  auditing  also  highlights  the  impor- 
tance of  the  auditor  having  a  clear  understanding  of 
the  audit  objectives,  the  scope  of  the  work  to  be 
conducted,  and  the  reporting  requirements. 
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12.    Audits  may  have  a  combination  of  financial  and 
performance  audit  objectives,  or  may  have  objec- 
tives limited  to  only  some  aspects  of  one  audit  type. 
For  example,  auditors  conduct  audits  of  govern- 
ment contracts  and  grants  with  private  sector  orga- 
nizations, as  well  as  government  and  nonprofit 
organizations,  that  often  include  both  financial  and 
performance  objectives.  These  are  commonly 
referred  to  as  "contract  audits"  or  "grant  audits." 
Other  examples  of  such  audits  include  specific 
audits  of  internal  controls,  compliance,  and  com- 
puter-based systems.  Auditors  should  follow  the 
appropriate  standards  in  this  statement  that  are 
applicable  to  the  individual  objectives  of  the  audit. 


Other  Activities  13- 
of  an  Audit 
Organization 


Auditors  may  perform  services  other  than  audits. 
For  example,  the  auditor  may  gather  information 
about  a  program,  activity,  or  function  without  anal- 
ysis, conclusions,  and  recommendations.  The  head 
of  the  audit  organization  should  establish  policy  on 
which  audit  standards  from  this  statement  should 
be  followed  by  the  auditors  in  performing  such  ser- 
vices. However,  as  a  minimum,  auditors  should  col- 
lectively possess  adequate  professional  proficiency 
and  exercise  due  professional  care  for  the  service 
being  performed. 


14.  An  audit  organization  may  be  authorized  to  perform 
investigative  work.  The  head  of  the  audit  organiza- 
tion should  establish  policy  on  whether  the  audit 
standards  in  this  statement,  or  some  other  appropri- 
ate standards,  are  to  be  followed  by  the  employees 
performing  this  work. 

15.  Employees  of  an  audit  organization  may  also  per- 
form, within  the  audit  organization,  nonaudit  activi- 
ties, such  as  legal,  administrative,  and  computer 
processing  functions.  The  head  of  the  audit  organi- 
zation should  establish  policy  on  what  standards  in 
this  statement  are  to  be  followed,  or  whether  some 
other  appropriate  standards  are  to  be  followed,  by 
the  employees  in  performing  this  type  of  work. 
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Purpose 


1.  This  chapter  prescribes  general  standards  for  con- 
ducting financial  and  performance  audits.  These 
general  standards  relate  to  the  qualifications  of  the 
staff,  the  audit  organization's  and  the  individual 
auditor's  independence,  the  exercise  of  due  profes- 
sional care  in  conducting  the  audit  and  in  preparing 
related  reports,  and  the  presence  of  quality  con- 
trols. General  standards  are  distinct  from  those 
standards  that  relate  to  conducting  field  work  and 
preparing  related  reports. 

2.  These  general  standards  apply  to  all  audit  organiza- 
tions, both  government  and  nongovernment  (e.g., 
public  accounting  firms  and  consulting  firms),  con- 
ducting government  audits  unless  excluded  in  the 
general  standards  that  follow.  (The  aicpa's  general 
standards  are  similar  to  these  general  standards  but 
apply  mainly  to  the  members  of  the  aicpa.) 


Qualifications 


The  first  general  standard  for  government  auditing 
is: 


The  staff  assigned  to  conduct  the  audit  should 
collectively  possess  adequate  professional  profi- 
ciency for  the  tasks  required. 

4.  This  standard  places  responsibility  on  the  audit 
organization  to  ensure  that  the  audit  is  conducted 
by  staff  who  collectively  have  the  knowledge  and 
skills  necessary  for  the  audit  to  be  conducted.  They 
should  also  have  a  thorough  knowledge  of  the  gov- 
ernment environment  and  government  auditing  rel- 
ative to  the  nature  of  the  audit  being  conducted. 

5.  The  qualifications  mentioned  herein  apply  to  the 
knowledge  and  skills  of  the  audit  organization  as  a 
whole  and  not  necessarily  to  every  individual  audi- 
tor. If  an  organization  employs  personnel,  or  hires 
outside  consultants,  with  acceptable  knowledge  and 
skills  in  such  areas  as  accounting,  statistics,  law, 
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engineering,  audit  design  and  methodology,  auto- 
matic data  processing,  public  administration,  eco- 
nomics, social  sciences,  and  actuarial  science,  each 
individual  staff  member  need  not  possess  all  these 
skills  and  knowledge. 


Continuing 

Education 

Requirements 


To  meet  this  standard,  the  audit  organization 
should  have  a  program  to  ensure  that  its  staff  main- 
tain professional  proficiency  through  continuing 
education  and  training.  To  satisfy  this  requirement, 
auditors  responsible  for  planning,  directing,  con- 
ducting, or  reporting  on  government  audits  should 
complete,  every  2  years,  at  least  80  hours  of  contin- 
uing education  and  training  which  contributes  to 
the  auditor's  professional  proficiency.  At  least  20 
hours  should  be  completed  in  any  one  year  of  the  2- 
year  period.  Individuals  responsible  for  planning, 
directing,  conducting  substantial  portions  of  the 
field  work,  or  reporting  on  the  government  audit 
should  complete  at  least  24  of  the  80  hours  of  con- 
tinuing education  and  training  in  subjects  directly 
related  to  the  government  environment  and  to  gov- 
ernment auditing.1  If  the  audited  entity  operates  in 
a  specific  or  unique  environment,  auditors  should 
receive  training  that  is  related  to  that  environment. 

The  audit  organization  is  responsible  for  establish- 
ing and  implementing  a  program  to  ensure  that 
auditors  meet  the  continuing  education  and  training 
requirements  stated  above.  The  organization  should 
maintain  documentation  of  the  education  and  train- 
ing completed. 


1  All  continuing  education  and  training  requirements  should  be 
met  within  2  years  from  the  effective  date  of  the  standards.  For 
entry-level  employees  with  less  than  2  years  with  the  audit  organ- 
ization, on  the  effective  date  of  this  requirement,  a  prorata 
number  of  hours  would  be  acceptable. 
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The  continuing  education  and  training  may  include 
such  topics  as  current  developments  in  audit  meth- 
odology, accounting,  assessment  of  internal  con- 
trols, principles  of  management  and  supervision, 
financial  management,  statistical  sampling,  evalua- 
tion design,  and  data  analysis.  It  may  also  include 
subjects  related  to  the  auditor's  field  of  work,  such 
as  public  administration,  public  policy  and  struc- 
ture, industrial  engineering,  economics,  social  sci- 
ences, and  computer  science. 

External  consultants  and  internal  experts  and  spe- 
cialists should  be  qualified  and  maintain  their  pro- 
fessional proficiency  in  their  area  of  expertise  and/ 
or  specialization  but  are  not  required  to  meet  the 
above  continuing  education  and  training  require- 
ments. Auditors  performing  nonaudit  activities  and 
services  also  are  not  required  to  meet  the  above 
continuing  education  and  training  requirements. 


Staff  10-    Qualifications  for  staff  members  conducting  govern- 

Qualif ications  ment  audits  mclude: 

a.  A  knowledge  of  the  methods  and  techniques 
applicable  to  government  auditing  and  the  educa- 
tion, skills,  and  experience  to  apply  such  knowledge 
to  the  audit  being  conducted. 

b.  A  knowledge  of  government  organizations,  pro- 
grams, activities,  and  functions. 

c.  The  skills  to  communicate  clearly  and  effectively, 
both  orally  and  in  writing. 

d.  Skills  appropriate  for  the  audit  work  being  con- 
ducted. For  instance: 

(1)  If  the  work  requires  use  of  statistical  sampling, 
the  staff  or  consultants  to  the  staff  should  include 
persons  with  statistical  sampling  skills. 
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(2)  If  the  work  requires  extensive  review  of  comput- 
erized systems,  the  staff  or  consultants  to  the  staff 
should  include  persons  with  computer  audit  skills. 

(3)  If  the  work  involves  review  of  complex  engineer- 
ing data,  the  staff  or  consultants  to  the  staff  should 
include  persons  with  engineering  skills. 

(4)  If  the  work  involves  the  use  of  nontraditional 
audit  methodologies,  the  staff  or  consultants  to  the 
staff  should  include  persons  with  the  necessary 
skills. 

e.  The  following  qualifications  are  needed  for  finan- 
cial audits  that  lead  to  an  expression  of  an  opinion: 

(1)  The  auditor  should  be  proficient  in  the  appropri- 
ate accounting  principles  and  standards  and  in  gov- 
ernment auditing. 

(2)  The  public  accountants  engaged  to  conduct 
audits  should  be:  (a)  licensed  certified  public 
accountants  or  persons  working  for  a  licensed  certi- 
fied public  accounting  firm  or  (b)  public  account- 
ants licensed  on  or  before  December  31,  1970,  or 
persons  working  for  a  public  accounting  firm 
licensed  on  or  before  December  31,  1970.2 


Independence         n*    ^ne  seconc*  general  standard  for  government  audit- 
ing is: 

In  all  matters  relating  to  the  audit  work,  the 
audit  organization  and  the  individual  auditors, 
whether  government  or  public,  should  be  free 


2Accountants  and  accounting  firms  meeting  these  licensing 
requirements  should  also  comply  with  the  applicable  provisions 
of  the  public  accountancy  law  and  rules  of  the  jurisdiction(s) 
where  the  audit  is  being  conducted  and  the  jurisdiction(s)  in 
which  they  are  licensed. 
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from  personal  and  external  impairments  to  inde- 
pendence, should  be  organizationally  indepen- 
dent, and  should  maintain  an  independent 
attitude  and  appearance. 

12.  This  standard  places  responsibility  on  the  auditor 
and  the  audit  organization  to  maintain  indepen- 
dence so  that  opinions,  conclusions,  judgments,  and 
recommendations  will  be  impartial  and  will  be 
viewed  as  impartial  by  knowledgeable  third  parties. 

13.  Auditors  should  consider  not  only  whether  they  are 
independent  and  their  attitudes  and  beliefs  permit 
them  to  be  independent,  but  also  whether  there  is 
anything  about  their  situation  that  might  lead 
others  to  question  their  independence.  All  situations 
deserve  consideration  because  it  is  essential  not 
only  that  auditors  are,  in  fact,  independent  and 
impartial,  but  also  that  knowledgeable  third  parties 
consider  them  so. 

14.  Government  auditors,  including  hired  consultants 
and  internal  experts  and  specialists,  need  to  con- 
sider three  general  classes  of  impairments  to  inde- 
pendence— personal,  external,  and  organizational. 
If  one  or  more  of  these  impairments  affect  an  audi- 
tor's ability  to  do  the  work  and  report  findings 
impartially,  the  auditor  should  either  decline  to  per- 
form the  audit,  or  in  those  situations  when  the  audi- 
tor cannot  decline  to  perform  the  audit,  the 
impairment(s)  should  be  reported  in  the  scope  sec- 
tion of  the  audit  report.  In  addition,  in  cases  when 
the  auditors  are  employees  of  the  audited  entity, 
that  fact  should  be  reflected  in  a  prominent  place  in 
the  audit  report. 

15.  Nongovernmental  auditors  also  need  to  consider 
those  personal  and  external  impairments  that  might 
affect  their  ability  to  do  their  work  and  report  their 
findings  impartially.  If  their  ability  is  adversely 
affected,  they  should  decline  to  perform  the  audit. 
Public  accountants  should  also  follow  the  aicpa  code 
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of  professional  ethics,  the  code  of  professional  con- 
duct of  the  state  board  with  jurisdiction  over  the 
practice  of  the  public  accountant  and  the  audit 
organization,  and  the  personal  and  external  impair- 
ments included  in  this  statement. 


Personal  16-    There  are  circumstances  in  which  auditors  may  not 

Impairments  ^  iroP2111^ or  may  not  ^  perceived  to  be  impar- 

tial.  The  audit  organization  is  responsible  for  hav- 
ing policies  and  procedures  in  place  to  help 
determine  if  auditors  have  any  personal  impair- 
ments. Managers  and  supervisors  need  to  be  alert 
for  personal  impairments  of  their  staff  members. 
Auditors  are  responsible  for  notifying  the  appropri- 
ate official  within  their  audit  organization  if  they 
have  any  personal  impairments.  These  impairments 
apply  to  individual  auditors,  but  they  may  also 
apply  to  the  audit  organization.  Personal  impair- 
ments may  include,  but  are  not  limited  to,  the 
following. 

a.  Official,  professional,  personal,  or  financial  rela- 
tionships3 that  might  cause  the  auditor  to  limit  the 
extent  of  the  inquiry,  to  limit  disclosure,  or  to 
weaken  or  slant  audit  findings  in  any  way. 

b.  Preconceived  ideas  toward  individuals,  groups, 
organizations,  or  objectives  of  a  particular  program 
that  could  bias  the  audit. 

c.  Previous  responsibility  for  decision-making  or 
managing  an  entity  that  would  affect  current  opera- 
tions of  the  entity  or  program  being  audited. 

d.  Biases,  including  those  induced  by  political  or 
social  convictions,  that  result  from  employment  in, 


3When  auditing  state  and  local  governments,  the  public  account- 
ant should  be  familiar  with  AICPA  Professional  Ethics  Interpreta- 
tion 101-10.  This  interpretation  establishes  specific  rules  on 
financial  relationships  that  impair  the  public  accountant's 
independence. 
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or  loyalty  to,  a  particular  group,  organization,  or 
level  of  government. 

e.  Subsequent  performance  of  an  audit  by  the  same 
individual  who,  for  example,  had  previously 
approved  invoices,  payrolls,  claims,  and  other  pro- 
posed payments  of  the  entity  or  program  being 
audited. 

f .  Concurrent  or  subsequent  performance  of  an 
audit  by  the  same  individual  who  maintained  the 
official  accounting  records.4 

g.  Financial  interest,  direct  or  substantial  indirect, 
in  the  audited  entity  or  program. 


External 
Impairments 


17.   Factors  external  to  the  audit  organization  may 
restrict  the  audit  or  interfere  with  an  auditor's  abil- 
ity to  form  independent  and  objective  opinions  and 
conclusions.  For  example,  under  the  following  con- 
ditions an  audit  may  be  adversely  affected  and  the 
auditor  may  not  have  complete  freedom  to  make  an 
independent  and  objective  judgment. 

a.  Interference  or  influence  external  to  the  audit 
organization  that  improperly  or  imprudently  limits 
or  modifies  the  scope  of  an  audit. 

b.  Interference  external  to  the  audit  organization 
with  the  selection  or  application  of  audit  proce- 
dures or  in  the  selection  of  transactions  to  be 
examined. 


4  For  example,  an  individual  performs  a  substantial  part  of  the 
accounting  process  or  cycle,  such  as  analyzing,  journalizing,  post- 
ing, preparing  adjusting  and  closing  entries,  and  preparing  the 
financial  statements,  and  later  the  same  individual  performs  an 
audit  In  instances  in  which  the  auditor  acts  as  the  main  processor 
for  transactions  initiated  by  the  audited  entity,  but  the  audited 
entity  acknowledges  responsibility  for  the  financial  records  and 
financial  statements,  the  independence  of  the  auditor  is  not  neces- 
sarily impaired 
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c.  Unreasonable  restrictions  on  the  time  allowed  to 
competently  complete  an  audit. 

d.  Interference  external  to  the  audit  organization  in 
the  assignment,  appointment,  and  promotion  of 
audit  personnel. 

e.  Restrictions  on  funds  or  other  resources  provided 
to  the  audit  organization  that  would  adversely 
affect  the  audit  organization's  ability  to  carry  out 
its  responsibilities. 

f.  Authority  to  overrule  or  to  influence  the  auditor's 
judgment  as  to  the  appropriate  content  of  an  audit 
report. 

g.  Influences  that  jeopardize  the  auditor's  continued 
employment  for  reasons  other  than  competency  or 
the  need  for  audit  services. 


Organizational 
Independence 


18.    Government  auditors'  independence  can  be  affected 
by  their  place  within  the  structure  of  the  govern- 
ment entity  to  which  they  are  assigned  and  also  by 
whether  they  are  auditing  internally  or  auditing 
other  entities. 


Internal  Auditors 


19.  A  federal,  state,  or  local  government  audit  organiza- 
tion, or  an  audit  organization  within  other  govern- 
ment entities,  such  as  a  government  college, 
university,  or  hospital,  may  be  subject  to  adminis- 
trative direction  from  persons  involved  in  the  gov- 
ernment management  process.  To  help  achieve 
organizational  independence,  the  audit  organization 
should  report  the  results  of  their  audits  and  be 
accountable  to  the  head  or  deputy  head  of  the  gov- 
ernment entity  and  should  be  organizationally 
located  outside  the  staff  or  line  management  func- 
tion of  the  unit  under  audit. 

20.  Auditors  should  also  be  sufficiently  removed  from 
political  pressures  to  ensure  that  they  can  conduct 
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their  audits  objectively  and  can  report  their  find- 
ings, opinions,  and  conclusions  objectively  without 
fear  of  political  repercussion.  Whenever  feasible, 
they  should  be  under  a  personnel  system  in  which 
compensation,  training,  job  tenure,  and  advance- 
ment are  based  on  merit. 

21.  If  the  above  conditions  are  met,  and  no  personal  or 
external  impairments  exist,  the  audit  staff  should 
be  considered  organizationally  independent  to  audit 
internally  and  free  to  report  objectively  to  top 
management. 

22.  When  organizationally  independent  internal  audi- 
tors conduct  audits  external  to  the  government 
entity  to  which  they  are  directly  assigned,  they  may 
be  considered  independent  of  the  audited  entity  and 
free  to  report  objectively  to  the  head  or  deputy 
head  of  the  government  entity  to  which  assigned. 


External  Auditors  23.    Government  auditors  employed  by  audit  organiza- 

tions whose  heads  are  elected  and  legislative  audi- 
tors auditing  executive  entities  may  be  considered 
free  of  organizational  impairments  when  auditing 
outside  the  government  entity  to  which  they  are 
assigned. 

24.  Government  auditors  may  be  presumed  to  be  inde- 
pendent of  the  audited  entity,  assuming  no  personal 
or  external  impairments  exist,  if  the  entity  is: 

a,  A  level  of  government  other  than  the  one  to 
which  they  are  assigned  (federal,  state,  or  local). 

b.  A  different  branch  of  government  within  the 
level  of  government  to  which  they  are  assigned  (leg- 
islative, executive,  or  judicial). 

25.  Government  auditors  may  also  be  presumed  to  be 
independent,  assuming  no  personal  or  external 
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impairments  exist,  if  the  audit  organization's  head 
is: 

a.  Elected  by  the  citizens  of  their  jurisdiction. 

b.  Elected  or  appointed  by  a  legislative  body  of  the 
level  of  government  to  which  they  are  assigned  and 
report  the  results  of  their  audits  to  and  are  account- 
able to  the  legislative  body. 

c.  Appointed  by  the  chief  executive  but  are  con- 
firmed by,  report  the  results  of  their  audits  to,  and 
are  accountable  to  a  legislative  body  of  the  level  of 
government  to  which  they  are  assigned. 


Y)\xe  26.    The  third  general  standard  for  government  auditing 

Professional 

Care  Due  professional  care  should  be  used  in  con- 

ducting the  audit  and  in  preparing  related 
reports. 

27.  This  standard  places  responsibility  on  the  auditor 
and  the  audit  organization  to  follow  all  applicable 
standards  in  conducting  government  audits.  Audi- 
tors should  use  sound  professional  judgment  in 
determining  the  standards  that  are  applicable  to  the 
work  to  be  conducted,  and  therefore  should  be  fol- 
lowed. Situations  may  occur  where  government 
auditors  are  not  able  to  follow  an  applicable  stand- 
ard and  are  not  able  to  withdraw  from  the  audit.  In 
these  situations,  the  auditors  should  disclose  in  the 
scope  section  of  their  report,  the  fact  that  an  appli- 
cable standard  was  not  followed,  the  reasons  there- 
for, and  the  known  effect  not  following  the 
standard  had  on  the  results  of  the  audit.  The  audi- 
tors' determination  that  certain  standards  do  not 
apply  to  the  audit  should  be  documented  in  the 
working  papers. 

28.  Exercising  due  professional  care  means  using  sound 
judgment  in  establishing  the  scope,  selecting  the 
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methodology,  and  choosing  tests  and  procedures  for 
the  audit.  The  same  sound  judgment  should  be 
applied  in  conducting  the  tests  and  procedures  and 
in  evaluating  and  reporting  on  the  audit  results.  At 
a  minimum,  determining  the  scope  of  the  audit  to  be 
conducted,  the  methodology  to  be  used,  and  the 
extent  of  tests  and  procedures  to  be  conducted 
requires  consideration  of: 

a.  What  is  necessary  to  achieve  the  audit  objectives. 

b.  Materiality  and/or  significance  of  matters  to 
which  the  tests,  procedures,  and  methodology  are 
applied. 

c  Effectiveness  and/or  efficiency  of  internal 
controls. 

d.  Cost  versus  benefits  of  the  audit  and  the  extent 
of  the  work  being  done.  (However,  situations  may 
occur  in  which  an  audit  organization  is  required  to 
conduct  an  audit  even  though  the  cost  of  the  audit 
exceeds  the  benefits  to  be  derived.) 

e.  Reporting  timeframes  that  must  be  met. 

29.    The  quality  of  audit  work  and  related  reports 
depends  upon  the  degree  to  which: 

a.  The  audit  scope,  methodology,  and  the  tests  and 
procedures  used  in  the  audit  are  adequate  to  pro- 
vide reasonable  assurance  that  the  audit  objectives 
are  accomplished.  When  appropriate,  statistical 
sampling,  standardized  data  collection,  statistical 
inference,  quantitative  techniques,  and  other 
aspects  of  quantitative  analysis  should  be  used. 

b.  Findings  and  conclusions  are  based  on  an  objec- 
tive evaluation  of  pertinent  evidence. 

c  Findings  and  conclusions  in  reports  are  fully  sup- 
ported by  sufficient,  competent,  and  relevant  evi- 
dence obtained  or  developed  during  the  audit. 
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d.  The  audit  process  conforms  with  the  field  work 
standards  and  the  reporting  standards  set  forth  in 
this  statement. 

e.  A  supervisory  review  is  made  of  the  work  con- 
ducted, the  judgments  made  in  the  audit,  and  the 
audit  report. 

30.  A  body  of  technical  knowledge  on  types  of  audits, 
tests,  procedures,  and  methodology  exists.  Some  are 
generalized  and  some  are  specific  to  certain  indus- 
tries, types  of  audits,  or  special  circumstances. 
Auditors  should  have  a  sufficient  awareness  of  this 
body  of  knowledge  to  apply  it  to  the  audit  being 
undertaken.  This  awareness  is  necessary  to  ensure 
that  the  selected  methodology,  tests  and  procedures 
are  appropriate. 

31.  Due  professional  care  also  includes  obtaining  a 
mutual  understanding  of  the  audit  objectives  and 
scope  with  the  audited  entity  as  well  as  with  those 
who  authorized  or  requested  the  audit.  It  also 
includes  obtaining  a  working  understanding  of  the 
operations  to  be  audited  and  when  necessary,  avail- 
able performance  measurement  criteria  (including 
laws  and  regulations).  When  the  criteria  are  vague, 
the  auditors  should  seek  interpretation.  If  interpre- 
tation is  not  available,  auditors  should  strive  to 
agree  on  the  appropriateness  of  these  measures 
with  the  interested  parties,  or  if  applicable,  indicate 
that  they  were  unable  to  report  upon  performance 
because  of  the  lack  of  definitive  criteria. 

32.  While  this  standard  also  places  responsibility  on  the 
auditor  and  audit  organization  to  exercise  due  pro- 
fessional care  in  the  performance  of  a  quality 
appropriate  for  the  audit  assignment  undertaken,  it 
does  not  imply  unlimited  responsibility;  neither 
does  it  imply  infallibility  on  the  part  of  either  the 
individual  auditor  or  the  audit  organization. 
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Materiality  and 
Significance 


33.    The  auditor  should  consider  materiality  and/or  sig- 
nificance in  planning  the  audit  and  in  selecting  the 
methodology  and  designing  audit  tests  and  proce- 
dures as  well  as  in  deciding  whether  a  matter 
requires  disclosure  in  an  audit  report.  One  of  the 
criteria  to  be  considered  in  determining  materiality 
includes  the  monetary  value  of  the  item.  However, 
materiality  and  significance  often  depend  on  quali- 
tative as  well  as  quantitative  factors.  Qualitative 
factors  include,  but  are  not  limited  to  the  cumula- 
tive effect  and  impact  of  immaterial  items,  the 
objectives  of  the  work  undertaken,  and  the  use  of 
the  reported  information  by  the  user  or  groups  of 
users  of  the  information.  Decisions  on  these  criteria 
are  based  on  the  auditor's  professional  judgment.  In 
government  audits  the  materiality  level  and/or 
threshold  of  acceptable  risk  may  be  lower  than  in 
similar-type  audits  in  the  private  sector  because  of 
the  public  accountability  of  the  entity,  the  various 
legal  and  regulatory  requirements,  and  the  visibility 
and  sensitivity  of  government  programs,  activities, 
and  functions. 


34.    In  determining  materiality  and/or  significance  and 
audit  risk  the  auditor  may  consider  the  following. 

a.  Amount  of  revenues  and  expenditures. 

b.  Newness  of  the  activity  or  changes  in  its 
conditions. 

c.  Adequacy  of  internal  controls. 

d.  Results  of  prior  audits. 

e.  Level  and  extent  of  review  or  other  form  of  inde- 
pendent oversight. 

f.  Adequacy  of  the  internal  controls  for  ensuring 
compliance  with  laws  and  regulations. 

g.  Management's  adherence  to  applicable  laws  and 
regulations. 
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h.  Audit  report  users'  expectations. 

i.  Public  perceptions  and  political  sensitivity  of  the 
areas  under  audit. 

j.  Audit  requirements. 


Relying  on  Work      35-    One  factor  underlying  government  auditing  is  that 
of  Others  federal,  state,  and  local  governments  cooperate  in 

auditing  programs  of  common  interest  so  that  audi- 
tors may  use  other's  work  and  avoid  duplicate  audit 
efforts.  In  conducting  an  audit,  auditors  may  rely 
on  the  work  of  others  to  the  extent  feasible  once 
they  satisfy  themselves  of  the  quality  of  the  others 
work  by  appropriate  tests  or  by  other  acceptable 
methods. 

36.    Relying  on  the  work  of  others  reduces  the  amount 
of  work  necessary  for  the  auditor  to  accomplish  the 
audit  objective(s). 

87.  In  determining  whether  to  rely  upon  the  work  of 
others,  the  auditor  should  consider  the  following 
guidance. 

a.  When  the  other  auditors  are  external  auditors, 
tests  should  include  making  inquiries  into  the  pro- 
fessional reputation,  qualifications,  and  indepen- 
dence of  the  auditors.  The  auditors  should  consider 
whether  to  (1)  conduct  additional  tests  and  proce- 
dures such  as  reviewing  the  audit  procedures  fol- 
lowed and  results  of  the  audit  conducted  by  the 
other  auditors;  (2)  review  the  audit  programs  of  the 
other  auditors;  and/or  (3)  review  the  working 
papers,  including  their  understanding  and  assess- 
ment of  internal  controls,  tests  of  compliance,  and 
the  conclusions  reached  by  the  other  auditors.  The 
auditors  may  review  the  documentary  evidence  in 
the  other  auditors'  working  papers  or  make  supple- 
mental tests  of  the  work  conducted. 
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b.  When  the  other  auditors  are  internal  auditors, 
tests  should  include  (1)  determining  whether  they 
are  qualified,  (2)  determining  whether  they  are 
properly  located  in  the  organization  in  order  to  pro- 
vide them  with  sufficient  independence  to  conduct 
the  audit  objectively,  (3)  determining  whether  their 
work  is  acceptable  by  examining,  on  a  test  basis,  the 
documentary  evidence  of  the  work  conducted,  and 
(4)  conducting  tests  of  the  work.  These  tests  may 
either  (i)  examine  some  of  the  transactions,  bal- 
ances, or  work  the  internal  auditors  examined  or 
(ii)  examine  similar  transactions,  balances,  or  work, 
but  not  those  actually  examined  by  internal  audi- 
tors. Based  upon  this  review,  the  auditors  would 
decide  what  additional  work,  if  any,  would  have  to 
be  done  in  order  to  accept  the  work  of  the  internal 
auditors. 

c.  When  relying  upon  the  work  of  nonauditors  (con- 
sultants, experts,  specialists,  etc.,  other  than  those 
hired  to  assist  in  the  audit),  the  auditors  should  sat- 
isfy themselves  as  to  the  nonauditors  professional 
reputation,  qualifications,  and  independence  from 
the  organization,  program,  activity,  or  function 
under  audit.  The  auditors  should  also  consider 
whether  to  (1)  conduct  additional  tests  and  proce- 
dures such  as  reviewing  the  procedures  followed 
and  the  results  of  the  work  conducted,  (2)  review 
the  work  program,  (3)  review  the  working  papers, 
(4)  make  supplemental  tests  of  the  work  conducted, 
and  (5)  consider  the  methods  or  assumptions  used. 

d.  The  auditors  should  determine  whether  the 
above  audit  organizations  have  an  appropriate 
internal  quality  control  system  in  place  and 
whether  the  organization  participates  in  an  external 
quality  control  review  program. 

38.    Auditors  need  access  to  the  working  papers  of  other 
auditors  and  nonauditors  to  satisfy  certain  of  the 
above  requirements.  For  working  papers  containing 
restricted  information,  the  appropriate  policies 
should  be  followed. 
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39.  Arrangements  need  to  be  made  to  ensure  that  work- 
ing papers  will  be  made  available  upon  request  to 
other  government  audit  staffs  and  individual  audi- 
tors. All  contractual  arrangements  for  government 
audits  should  provide  for  access  to  working  papers. 

40.  When  auditors  decide  to  rely  on  the  work  of  others, 
but  do  not  take  full  responsibility  for  that  work,  the 
auditors  should  indicate  in  the  scope  section  of  the 
audit  report  the  division  of  responsibility  between 
that  portion  of  the  work  they  conducted  and  that 
conducted  by  others,  and  the  magnitude  of  the 
audit  work  completed  by  others.^ 


Audit 
Follow-Up 


41.    Due  professional  care  also  includes  follow-up  on 
known  findings  and  recommendations  from  previ- 
ous audits  that  could  have  an  effect  on  the  current 
audit  objectives  to  determine  whether  prompt  and 
appropriate  corrective  actions  have  been  taken  by 
entity  officials  or  other  appropriate  organizations. 
Management  of  the  audited  entity  is  primarily 
responsible  for  directing  action  and  follow-up  on 
recommendations.  The  auditor's  report  should  dis- 
close the  status  of  known  but  uncorrected  signifi- 
cant or  material  findings  and  recommendations 
from  prior  audits  that  effect  the  current  audit 
objective.  Government  auditors  should  have  a  pro- 
cess that  enables  them  to  track  the  status  of  man- 
agement's actions  on  significant  or  material  findings 
and  recommendations  from  their  prior  audits. 


Audit  Scope 
Impairments 


42.    For  all  audits,  auditors  should  consider  whether 
audit  scope  impairments  will  adversely  affect  their 
ability  to  conduct  the  audit  in  accordance  with  the 


5This  guidance  does  not  preclude  auditors  from  referring  to 
other's  work  in  their  audit  report  even  if  the  auditors  did  not  ver- 
ify it,  if  the  work  is  used  only  for  background  or  informational 
purposes  and  is  not  material  or  significant  to  the  auditors'  report. 
In  these  situations  the  auditors  may  just  cite  the  information  and 
its  source  in  their  audit  report. 
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standards  in  this  statement.  Audit  scope  impair- 
ments are  factors  external  to  the  audit  organization 
which  can  restrict  the  auditors'  ability  to  render 
objective  opinions  and  conclusions.  The  auditors 
should  attempt  to  remove  the  impairment.  Failing 
that,  the  auditors  should  disclose  the  impairment  in 
the  scope  section  of  their  report  and  the  known 
effect  it  had  on  the  results  of  the  audit.  Two  exam- 
ples of  audit  scope  impairments  are  the  denial  of 
access  to  sources  of  information  by  the  audited 
entity,  such  as  books,  records,  and  supporting  docu- 
ments, and  denial  by  the  audited  entity  of  the 
opportunity  to  meet  with  officials  and  employees  of 
the  organization,  program,  or  activity  under  audit. 


Quality 
Control 


43. 


The  fourth  general  standard  for  government  audit- 
ing is: 

Audit  organizations  conducting  government 
audits  should  have  an  appropriate  internal  qual- 
ity control  system  in  place  and  participate  in  an 
external  quality  control  review  program. 


44.  This  standard  places  responsibility  on  government 
and  nongovernment  audit  organizations  conducting 
government  audits  to  have  an  appropriate  internal 
quality  control  system  in  place  and  to  participate  in 
an  external  quality  control  review  program. 

45.  The  internal  quality  control  system  established  by 
the  organization  should  provide  reasonable  assur- 
ance that  it:  (1)  has  established,  and  is  following, 
adequate  audit  policies  and  procedures  and  (2)  has 
adopted,  and  is  following,  applicable  auditing  stan- 
dards. The  nature  and  extent  of  an  organization's 
internal  quality  control  system  depends  on  a 
number  of  factors,  such  as  its  size,  the  degree  of 
operating  autonomy  allowed  its  personnel  and  its 
audit  offices,  the  nature  of  its  work,  its  organiza- 
tional structure,  and  appropriate  cost-benefit  con- 
siderations. Thus,  the  systems  established  by 


Page  3-17 


Chapter  3 
General  Standards 


individual  organizations  will  vary,  as  well  as  the 
extent  of  their  documentation. 

46.    Organizations  conducting  government  audits  should 
have  an  external  quality  control  review  at  least 
once  every  3  years  by  an  organization  not  affiliated 
with  the  organization  being  reviewed.6  The  external 
quality  control  review  program  should  determine 
that:  (1)  the  organization's  internal  quality  control 
system  is  in  place  and  operating  effectively  and  (2) 
established  policies  and  procedures  and  applicable 
auditing  standards  are  being  followed  in  its  audit 
work,  including  its  government  audits.  However, 
external  quality  control  review  procedures  should 
be  tailored  to  the  size  and  nature  of  an  organiza- 
tion's audit  work.  For  example,  an  organization  that 
performs  only  a  few  government  audits  may  be 
more  effectively  reviewed  by  placing  the  primary 
emphasis  on  a  review  of  the  quality  of  specific  gov- 
ernment audits  rather  than  on  the  organization's 
internal  quality  control  policies  and  procedures. 

'47.    Audit  organizations  should  make  the  report  on 
external  quality  control  reviews  available  to  audi- 
tors using  their  work  and  to  appropriate  oversight 
bodies.  It  is  recommended  that  the  report  be  made 
available  to  the  public. 

48.    External  quality  control  review  programs,  such  as 
those  conducted  through  or  by  the  aicpa,  National 
State  Auditors  Association,  Intergovernmental 
Audit  Forums,  gao,  and  the  Institute  of  Internal 
Auditors,  would  be  acceptable.  Public  accountants 
should  participate  in  the  aicpa  practice-monitoring 
program  or  an  equivalent  program. 


Organizations  conducting  government  audits  should  have  an 
external  quality  control  review  within  3  years  from  the  effective 
date  of  the  standards. 
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Purpose 


l.    This  chapter  prescribes  standards  of  field  work  for 
government  financial  audits.  It  incorporates  the 
aicpa  standards  of  field  work  for  financial  audits, 
and  does  not  restate  them1  but  rather  prescribes 
supplemental  standards  of  field  work  needed  to  sat- 
isfy the  unique  needs  of  government  financial 
audits. 


2.  The  field  work  standards  of  the  aicpa  and  the  sup- 
plemental standards  in  this  chapter  apply  to  both 
financial  statement  audits  and  financial  related 
audits. 

3.  In  conducting  audits  in  accordance  with  the  stan- 
dards in  this  statement,  the  auditors  choose  and 
conduct  auditing  tests  and  procedures  that,  in  their 
professional  judgment,  are  appropriate  in  the  cir- 
cumstances to  achieve  the  audit  objectives.  Such 
tests  and  procedures  are  designed  to  obtain  suffi- 
cient, competent,  and  relevant  evidence  that  will 
provide  a  reasonable  basis  for  their  opinions,  judg- 
ments, and  conclusions  regarding  the  audit 
objectives. 


Planning 


Audit 

Requirements 
for  All 
Government 
Levels 


4.  The  first  supplemental  planning  field  work  stand- 
ard for  government  financial  audits  is: 

Planning  should  include  consideration  of  the 
audit  requirements  of  all  levels  of  government. 

5.  In  many  instances,  audits  of  the  same  organizations, 
programs,  activities,  or  functions  may  be  required 
by  federal,  state,  and  local  laws,  regulations,  and 


1  Future  statements  will  be  adopted  and  incorporated  unless  GAO 
excludes  them  by  formal  announcement. 
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ordinances.2  When  this  situation  exists,  the  auditor 
should  ascertain  what  governments  are  to  be  served 
by  the  audit,  and,  to  the  maximum  extent  practica- 
ble, plan  the  audit  so  that  it  will  help  fulfill  the  legal 
and  regulatory  needs  of  identified  potential  users. 


Legal  and 

Regulatory 

Requirements 


6.  The  second  supplemental  planning  field  work  stand- 
ard for  government  financial  audits  is: 

A  test  should  be  made  of  compliance  with  appli- 
cable laws  and  regulations. 

7.  In  government  auditing,  compliance  with  laws  and 
regulations  is  important  because  government  orga- 
nizations, programs,  activities,  and  functions  are 
usually  created  by  law  and  are  subject  to  more  spe- 
cific rules  and  regulations  than  the  private  sector. 

8.  An  entity's  management  is  responsible  for  estab- 
lishing an  internal  control  structure  to  assure  com- 
pliance with  laws  and  regulations.  The  lack  of 
administrative  continuity  in  government  units 
because  of  continuing  changes  in  elected  legislative 
bodies  and  in  administrative  organizations  increases 
the  need  for  an  effective  internal  control  system. 

9.  In  determining  the  nature,  timing,  and  extent  of  the 
audit  steps  and  procedures  to  test  for  compliance, 
the  auditor  should  assess  the  risk  of  noncompliance 
with  laws  and  regulations  occurring  and  having  a 
direct  and  material  effect  on  the  financial  state- 
ments or  the  results  of  financial  related  audits.  The 


2When  auditing  state  and  local  governments  that  receive  federal 
financial  assistance,  the  auditor  should  be  familiar  with  the  Single 
Audit  Act  of  1984  (31  U.S.C.  7501-7507),  OMB  Circular  A-128, 
"Audits  of  State  and  Local  Governments,"  "OMB  Compliance  Sup- 
plement," and  AICPA  audit  and  accounting  guide,  Audits  of  State 
and  Local  Governmental  Units.  The  act  and  circular  include  spe- 
cific audit  requirements  that  exceed  the  minimum  audit  require- 
ments set  forth  in  the  standards  in  chapters  4  and  5  of  this 
statement,  mainly  in  the  areas  of  internal  control  and  compliance 
with  laws  and  regulations. 
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auditor  should  assess  the  risk  that  the  entity  did 
not  comply  with  those  laws  and  regulations  and  the 
risk  that  the  entity's  control  structure  to  ensure 
compliance  with  laws  and  regulations  might  not 
prevent  or  detect  that  noncompliance.3 

10.  In  planning  and  conducting  the  tests  of  compliance 
the  auditor  should: 

a.  Identify  the  pertinent  laws  and  regulations  and 
determine  which  of  those  laws  and  regulations 
could,  if  not  observed,  have  a  direct  and  material 
effect  on  the  financial  statements  or  the  results  of  a 
financial  related  audit. 

b.  Assess,  for  each  material  requirement,  the  risks 
that  material  noncompliance  could  occur.  This 
includes  consideration  and  assessment  of  the  inter- 
nal controls  in  place  to  assure  compliance  with  laws 
and  regulations. 

c.  Based  on  that  assessment,  design  steps  and  proce- 
dures to  test  compliance  with  laws  and  regulations 
to  provide  reasonable  assurance  of  detecting  both 
unintentional  instances  of  noncompliance  and  inten- 
tional instances  of  noncompliance  that  could  have  a 
material  effect  on  the  financial  statements  or  the 
results  of  a  financial  related  audit. 

11.  Auditors  can  obtain  information  about  the  applica- 
ble laws  and  regulations  from  the  audited  entity. 
When  funding  from  another  level  of  government  is 
involved  and  the  source  of  funding  is  known,  the 
auditor  can  obtain  or  corroborate  information  about 
the  applicable  laws  and  regulations  from  that 
source. 


3The  Single  Audit  Act  (31  U.S.C.  7502  (d)  (2)  (B))  also  requires 
the  auditor  to  determine  and  report  whether  the  entity  has  inter- 
nal controls  that  provide  reasonable  assurance  that  it  is  managing 
federal  financial  assistance  programs  in  compliance  with  applica- 
ble laws  and  regulations. 
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12.    The  laws  and  regulations  of  primary  concern  in 
financial  audits  are  those  that  have  a  direct  and 
material  effect  on  the  determination  of  financial 
amounts.4  Other  laws  and  regulations  that  pertain 
more  to  the  operations  aspects  of  an  entity  often 
will  relate  only  indirectly  to  the  financial  amounts 
that  effect  the  financial  statements  or  the  results  of 
financial  related  audits. 


Errors,  Irregularities 
and  Illegal  Acts 


13.    In  determining  compliance  with  laws  and 
regulations: 

The  auditor  should  design  audit  steps  and  proce- 
dures to  provide  reasonable  assurance  of 
detecting  errors,  irregularities,  and  illegal  acts 
that  could  have  a  direct  and  material  effect  on 
the  financial  statement  amounts  or  the  results 
of  financial  related  audits. 

The  auditor  should  also  be  aware  of  the  possibil- 
ity of  illegal  acts  that  could  have  an  indirect  and 
material  effect  on  the  financial  statements  or 
results  of  financial  related  audits. 


14.    In  fulfilling  the  above  requirements  relating  to 
errors,  irregularities,  and  illegal  acts,  the  auditor 
should  follow  the  guidance  contained  in  the  aicpa 
standards  entitled  The  Auditor's  Responsibility  to 
Detect  and  Report  Errors  and  Irregularities  and  Ille- 
gal Acts  By  Clients! 


Due  Care 
Concerning 
Illegal  Acts 


15.    Auditors  should  exercise  due  professional  care  and 
caution  in  extending  audit  steps  and  procedures  rel- 
ative to  illegal  acts  so  as  not  to  interfere  with  poten- 
tial future  investigations  and/or  legal  proceedings. 

4The  Single  Audit  Act  (31  U.S.C.  7502  (d)  (2)  (C))  expands  upon 
these  requirements  and  also  requires  the  auditor  to  determine  and 
report  on  whether  the  entity  has  complied  with  laws  and  regula- 
tions that  may  have  a  material  effect  upon  each  major  federal 
assistance  program  as  defined  in  the  act.  Other  similar  require- 
ments may  exist  in  state  and  local  government  jurisdictions. 


Page  4-4 


Chapter  4 

Field  Work  Standards  for 

Financial  Audits 


Due  care  would  include  consulting  appropriate  legal 
counsel  and/or  the  applicable  law  enforcement 
organizations,  where  appropriate,  to  determine  the 
audit  steps  and  procedures  to  be  followed. 

16.  Circumstances  may  exist  where  laws,  regulations, 
or  policies  require  the  auditor  to  promptly  report 
indications  of  certain  types  of  illegal  acts  to  law 
enforcement  or  investigatory  authorities  before 
extending  audit  steps  and  procedures.  The  auditor 
may  also  be  required  to  withdraw  from  or  defer 
further  work  on  the  audit  or  a  portion  of  the  audit 
in  order  not  to  interfere  with  an  investigation.  How- 
ever, the  auditor  should  consider  whether  the  above 
circumstances  would  restrict  the  completion  of  the 
remaining  portion  of  the  audit  or  interfere  with  the 
auditor's  ability  to  form  objective  opinions  and  con- 
clusions. If  it  restricts  or  interferes,  the  auditor 
should  consider  discontinuing  further  action  until 
completion  of  the  investigation,  or  terminate  the 
audit. 

17.  Most  auditors  are  not  trained  to  conduct  investiga- 
tions of  certain  types  of  illegal  acts  which  are  the 
responsibility  of  the  investigator  or  law  enforce- 
ment authorities.  However,  auditors  are  responsible 
for  being  aware  of  the  characteristics  and  types  of 
illegal  expenditures  and  acts  associated  with  the 
area  being  audited  to  be  able  to  identify  indications 
that  these  acts  may  have  occurred. 

18.  An  audit  made  in  accordance  with  the  standards  in 
this  statement  will  not  guarantee  the  discovery  of 
all  illegal  acts  or  contingent  liabilities  resulting  from 
noncompliance.  Nor  does  the  subsequent  discovery 
of  illegal  acts  committed  during  the  audit  period 
necessarily  mean  that  the  auditor's  performance 
was  inadequate  provided  the  audit  was  made  in 
accordance  with  these  standards. 
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Working 
Papers 


19.  The  aicpa  field  work  standards  and  this  statement 
require  that: 

A  record  of  the  auditors*  work  be  retained  in  the 
form  of  working  papers. 

20.  Working  papers  are  the  link  between  field  work  and 
the  auditors'  report.  They  serve  as  a  record  of  the 
results  of  the  audit  and  the  basis  of  the  auditors' 
opinions. 

21.  Audit  organizations  should  establish  policies  and 
procedures  to  ensure  the  safe  custody  and  retention 
of  working  papers  for  a  time  sufficient  to  satisfy 
legal  and  administrative  requirements. 

22.  Supplemental  working  paper  requirements  for 
financial  audits  are  that  working  papers  should: 

a.  Contain  a  written  audit  program  cross-referenced 
to  the  working  papers. 

b.  Contain  the  objective,  scope,  methodology,  and 
results  of  the  audit. 

c.  Contain  sufficient  information  so  that,  supple- 
mentary oral  explanations  are  not  required. 

d.  Be  legible  with  adequate  indexing  and  cross- 
referencing,  and  include  summaries  and  lead  sched- 
ules, as  appropriate. 

e.  Restrict  information  included  to  matters  that  are 
materially  important  and  relevant  to  the  objectives 
of  the  audit. 

f.  Contain  evidence  of  supervisory  reviews  of  the 
work  conducted. 
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Internal 
Control 


23.  The  aicpa  field  work  standards  and  this  statement 
require  that: 

A  sufficient  understanding  of  the  internal  con- 
trol structure  is  to  be  obtained  to  plan  the  audit 
and  to  determine  the  nature,  timing,  and  extent 
of  tests  to  be  performed. 

24.  Establishing  and  maintaining  an  internal  control 
structure  is  an  important  management  responsibil- 
ity. Good  internal  controls  are  essential  to  achieving 
the  proper  conduct  of  government  business  with 
full  accountability  for  the  resources  made  available. 
They  also  facilitate  the  achievement  of  management 
objectives  by  serving  as  checks  and  balances 
against  undesired  actions.  An  entity's  internal  con- 
trol structure  consists  of  the  policies  and  proce- 
dures established  to  provide  reasonable  assurance 
that  specific  entity  objectives  will  be  achieved.  The 
internal  control  structure  may  include  a  wide  vari- 
ety of  objectives  and  related  policies  and  proce- 
dures, only  some  of  which  may  be  relevant  to  an 
audit  of  the  entity's  financial  statements. 

25.  For  financial  audits,  the  auditor  is  primarily  con- 
cerned with  policies  and  procedures  that  pertain  to 
the  entity's  ability  to  record,  process,  summarize, 
and  report  financial  data  consistent  with  the  asser- 
tions embodied  in  the  financial  statements,  financial 
related  items  and  information  as  discussed  previ- 
ously, to  ensure  compliance  with  laws  and  regula- 
tions. Other  policies  and  procedures,  however,  may 
be  relevant  if  they  pertain  to  data  the  auditor  uses 
in  applying  auditing  procedures.  This  may  include, 
for  example,  policies  and  procedures  that  pertain  to 
nonfinancial  data  that  the  auditor  uses  in  analytical 
procedures. 

26.  An  entity  generally  has  internal  control  structure 
policies  and  procedures  that  are  not  relevant  to  a 
particular  audit  and  therefore  need  not  be  consid- 
ered. For  example,  policies  and  procedures  concern- 
ing the  effectiveness,  economy,  and  efficiency  of 
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certain  management  decision-making  processes, 
while  important  to  the  entity,  do  not  ordinarily 
relate  to  a  financial  audit. 

27.     In  fulfilling  the  audit  requirement  relating  to  an 
understanding  of  the  internal  control  structure  and 
assessing  the  level  of  control  risk,  the  auditor 
should  follow,  at  a  minimum,  the  guidance  con- 
tained in  the  aicpa  standard,  entitled  Consideration 
of  the  Internal  Control  Structure  in  a  Financial 
Statement  Audit. 
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Purpose 


This  chapter  prescribes  standards  of  reporting  for 
government  financial  audits.  It  incorporates  the 
aicpa  standards  of  reporting  for  financial  audits, 
and  does  not  restate  them1  but  rather  prescribes 
supplemental  standards  of  reporting  needed  to  sat- 
isfy the  unique  needs  of  government  financial 
audits. 


2.    The  reporting  standards  of  the  aicpa  and  the  sup- 
plemental standards  in  this  chapter  apply  to  both 
financial  statement  audits  and  financial  related 
audits. 


Statement  on 

Auditing 

Standards 


The  first  supplemental  reporting  standard  for  gov- 
ernment financial  audits  is: 

A  statement  should  be  included  in  the  auditor's 
report  that  the  audit  was  made  in  accordance 
with  generally  accepted  government  auditing 
standards.2  (aicpa  standards  require  that  public 
accountants  state  that  the  audit  was  made  in 
accordance  with  generally  accepted  auditing 
standards.  In  conducting  government  audits, 
public  accountants  should  also  state  that  their 
audit  was  conducted  in  accordance  with  the 
standards  set  forth  in  chapters  3,  4,  and  5.) 

The  above  statement  refers  to  all  the  applicable 
standards  that  the  auditors  should  have  followed 
during  their  audit.  The  statement  need  not  be  quali- 
fied when  standards  that  were  not  applicable  were 
not  followed.  However,  the  statement  should  be 
qualified  in  situations  where  the  auditors  did  not 


1  Future  AICPA  statements  will  be  adopted  and  incorporated 
unless  GAO  excludes  them  by  formal  announcement. 

2Generally  accepted  government  auditing  standards  (GAGAS) 
include  the  audit  standards  set  forth  in  this  publication,  Govern- 
ment Auditing  Standards  -  Standards  for  Audit  of  Governmental 
Organizations,  Programs,  Activities,  and  Functions,  subsequent 
revisions  and  interpretations,  and  guidance  concerning  these 
standards. 
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follow  an  applicable  standard.  In  these  situations, 
the  auditors  should  modify  the  statement  to  dis- 
close in  the  scope  section  of  their  report  the  applica- 
ble standard  that  was  not  followed,  the  reasons 
therefor,  and  the  known  effect  not  following  the 
standard  had  on  the  results  of  the  audit. 


Report  on 
Compliance 


5.    The  second  supplemental  reporting  standard  for 
government  financial  audits  is. 

The  auditors  should  prepare  a  written  report  on 
their  tests  of  compliance  with  applicable  laws 
and  regulations.  This  report,  which  may  be 
included  in  either  the  report  on  the  financial 
audit  or  a  separate  report,  should  contain  a 
statement  of  positive  assurance  on  those  items 
which  were  tested  for  compliance  and  negative 
assurance  on  those  items  not  tested.3  It  should 
include  all  material  instances  of  noncompli- 
ance,4 and  all  instances  or  indications  of  illegal 
acts  which  could  result  in  criminal  prosecution. 


Positive  and 

Negative 

Assurances 


6.    Positive  assurance  consists  of  a  statement  by  the 
auditors  that  the  tested  items  were  in  compliance 
with  applicable  laws  and  regulations.  Negative 
assurance  is  a  statement  that  nothing  came  to  the 
auditors'  attention  as  a  result  of  specified  proce- 
dures that  caused  them  to  believe  the  untested 
items  were  not  in  compliance  with  applicable  laws 


3If  a  statistically  valid  and  protectable  sample  of  items  was  tested, 
an  opinion  on  the  relevant  universe's  compliance  may  be 
warranted. 

4The  Single  Audit  Act  (31  U.S.C.  7502  (d)  (3))  also  requires  the 
auditor  to  report  all  instances  of  noncompliance  with  laws  and 
regulations  found  during  the  audit. 
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and  regulations.5  When  the  financial  audit  did  not 
require  tests  of  compliance  with  laws  and  regula- 
tions, the  report  should  contain  a  statement  that  the 
auditor  did  not  test  for  compliance  with  laws  and 
regulations. 


Noncompliance  7-   A11  material  instances  of  noncompliance  related  to 

the  entity's  financial  statements  or  the  program, 
award,  claim,  fund,  or  group  of  accounts  being 
audited  should  be  reported.  Further,  several 
instances  of  noncompliance  that  separately  may  not 
be  material,  but  that  cumulatively  could  have  a 
material  effect  on  the  financial  statements  or 
results  of  the  financial  related  audit,  should  be 
reported.  All  instances  of  illegal  acts  that  could 
result  in  the  audited  entity,  or  an  officer  or 
employee  of  the  audited  entity,  being  subject  to 
criminal  prosecution  should  also  be  reported. 

8.  Other  nonmaterial  instances  of  noncompliance  need 
not  be  disclosed  in  the  compliance  report  but  should 
be  reported  in  a  separate  communication  to  the 
audited  entity,  preferably  in  writing.6  Such 
instances  of  noncompliance  when  communicated  in 
a  management  letter  to  top  management  should  be 
referred  to  in  the  report  on  compliance.  All  commu- 
nications should  be  documented  in  the  working 
papers. 

9.  In  reporting  material  noncompliance,  the  auditors 
should  place  their  findings  in  proper  perspective. 
The  extent  of  noncompliance  should  be  related  to 
the  number  of  cases  examined  to  give  the  reader  a 
basis  forjudging  the  prevalence  of  noncompliance. 

5The  Single  Audit  Act  (31  U.S.C.  7502  (d)  (2)  (C))  contains  addi- 
tional requirements  for  the  auditor  to  determine  and  report  on 
whether  the  entity  has  complied  with  laws  and  regulations  that 
may  have  an  effect  upon  each  major  federal  assistance  program 
as  defined  in  the  act.  Other  similar  requirements  may  exist  in 
state  and  local  government  jurisdictions. 

6See  footnote  5  above. 
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If  a  valid  statistical  and  protectable  sample  was 
tested,  an  opinion  on  compliance  may  be  warranted. 
In  presenting  the  findings,  the  auditor  should  follow 
the  report  contents  standards,  as  appropriate,  for 
objectives,  scope  and  methodology,  audit  results, 
and  views  of  responsible  officials,  and  the  report 
presentation  standards,  discussed  in  chapter  7.7 


Illegal  Acts  10-    If  >  during  or  in  connection  with  an  audit  of  a  gov- 

ernment entity,  external  government  auditors 
become  aware  of  illegal  acts  or  indications  of  such 
acts  affecting  the  government  entity,  they  should 
promptly  report  to  the  top  official  of  that  entity. 
The  auditor  should  also  consider  reporting  to  the 
appropriate  oversight  body.  If  the  top  official  is 
believed  to  be  a  party  to  such  acts  or  otherwise 
implicated,  the  auditor  should  in  all  cases  report  to 
the  appropriate  oversight  body.  If  the  acts  involve 
funds  received  from  other  government  entities, 
auditors  should  also  promptly  report  to  the  proper 
officials,  including  the  audit  officials,  of  those 
entities. 

11.    Internal  government  auditors  auditing  a  govern- 
ment entity  that  is  external  to  the  government 
entity  to  which  they  are  assigned  should  promptly 
report  to  officials  and  authorities  in  accordance 
with  the  preceding  paragraph. 


'  Audit  findings  have  often  been  regarded  as  containing  the  ele- 
ments of  criteria,  condition,  and  effect,  plus  cause  when  problems 
are  found.  However,  the  elements  needed  for  a  complete  finding 
depend  entirely  on  the  objectives  of  the  audit.  Thus,  a  finding  or 
set  of  findings  is  complete  to  the  extent  that  the  audit  objectives 
are  satisfied  and  the  report  clearly  relates  those  objectives  to  the 
finding's  elements.  It  is  recognized  that  material  internal  control 
weaknesses  and  noncompliance  found  by  the  auditor  may  not 
always  have  all  of  these  elements  fully  developed,  given  the  scope 
and  objectives  of  the  specific  financial  audit.  But  at  least  the  audi- 
tor should  identify  the  condition,  criteria  and  possible  asserted 
effect  to  provide  sufficient  information  to  federal,  state,  and  local 
officials  to  permit  them  to  determine  the  effect  and  cause  in  order 
to  take  timely  and  proper  corrective  action. 
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12.  Internal  government  auditors  auditing  within  the 
government  entity  to  which  they  are  assigned 
should  report  to  the  top  officials  of  the  entity  under 
audit  (unless  the  official  is  believed  to  be  a  party  to 
such  acts)  and/or  appropriate  entity  investigative 
personnel. 

13.  Public  accountants  conducting  audits  of  govern- 
ment entities  will  discharge  their  responsibilities  for 
reporting  illegal  acts  or  indications  of  such  acts 
found  during  or  in  connection  with  an  audit  by 
promptly  reporting  to  the  top  official  of  the  entity 
arranging  for  the  audit  (including  audit  committees 
or  others  with  equivalent  authority).  The  auditor 
should  also  consider  reporting  to  the  appropriate 
oversight  body.  If  the  audited  entity  and  the  top 
official  is  believed  to  be  a  party  to  such  acts  or 
otherwise  implicated,  the  auditor  should  in  all  cases 
report  to  the  appropriate  oversight  body.  Also, 
when  the  illegal  acts  involve  funds  received  from 
other  government  entities,  the  audited  entity  should 
report  to  the  proper  officials,  including  those  at  the 
audit  organization,  of  those  entities.  If  the  audited 
entity  does  not  do  so  within  a  reasonable  time  or 
was  unable  to  because  the  top  official  was  involved, 
the  auditor  should  report  to  the  officials  of  those 
other  government  entities. 

14.  It  is  the  responsibility  of  an  entity  receiving  the 
information  from  the  various  auditors,  both  the 
audited  entity  and  external  funding  entity,  to  report 
to  appropriate  law  enforcement  authorities  and 
other  government  entities  whose  funds  are 
involved. 

15.  In  the  case  of  an  audit  of  government  funds 
received  by  a  nongovernment  entity,  the  auditors 
should  promptly  report  to  the  appropriate  govern- 
ment entity  requiring  or  arranging  for  the  audit  and 
such  other  officials  designated  by  law  or  regulation 
to  receive  the  audit  reports. 


Page  5  5 


Chapter  5 

Reporting  Standards  for 

Financial  Audits 


16.    Illegal  acts  or  indications  of  such  acts  that  auditors 
become  aware  of  need  not  be  included  in  the 
required  audit  reports,  but  may  be  covered  in  a  sep- 
arate written  report  and  submitted  in  accordance 
with  the  preceding  paragraphs,  thus  permitting  the 
required  report  or  reports  to  be  released.  However, 
auditors  generally  should  not  release  information  or 
reports  containing  information  on  such  acts  or 
reports  with  references  that  such  acts  were  omitted 
from  reports,  without  consulting  with  appropriate 
legal  counsel,  since  this  release  could  interfere  with 
legal  processes,  subject  the  implicated  individuals  to 
undue  publicity,  or  subject  the  auditor  to  potential 
legal  action. 


Report  on 

Internal 

Controls 


17.    The  third  supplemental  reporting  standard  for  gov- 
ernment financial  audits  is: 

The  auditors  should  prepare  a  written  report  on 
their  understanding  of  the  entity's  internal  con- 
trol structure  and  the  assessment  of  control  risk 
made  as  part  of  a  financial  statement  audit,8  or 
a  financial  related  audit.  This  report  may  be 
included  in  either  the  auditor's  report  on  the 
financial  audit  or  a  separate  report.  The  audi- 
tor's report  should  include  as  a  minimum:  (1)  the 
scope  of  the  auditor's  work  in  obtaining  an 
understanding  of  the  internal  control  structure 
and  in  assessing  the  control  risk,  (2)  the  entity's 
significant  internal  controls  or  control  structure 
including  the  controls  established  to  ensure 
compliance  with  laws  and  regulations  that  have 
a  material  impact  on  the  financial  statements 
and  results  of  the  financial  related  audit,  and 


HThis  standard  does  not  require  any  additional  audit  work  other 
than  that  required  as  part  of  a  financial  audit  described  in  this 
statement.  However,  the  Single  Audit  Act  (31  U.S.C.  7502  (d)  (2) 
(B))  expands  upon  this  requirement  and  also  requires  that  the 
auditor  determine  and  report  whether  the  entity  has  internal  con- 
trols that  provide  reasonable  assurance  that  it  is  managing  fed- 
eral financial  assistance  programs  in  compliance  with  applicable 
laws  and  regulations. 
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(3)  the  reportable  conditions,  including  the  iden- 
tification of  material  weaknesses,  identified  as  a 
result  of  the  auditor's  work  in  understanding 
and  assessing  the  control  risk. 

18.  In  identifying  the  scope  of  the  auditor's  work,  the 
report  should  include  a  description  of  the  work  con- 
ducted. Generally  accepted  government  auditing 
standards  require  the  auditor  to  understand  and 
assess  the  audited  entity's  internal  control  struc- 
ture, which  consists  of  the  control  environment, 
accounting  systems,  and  specific  internal  control 
procedures,  to  plan  the  financial  audit.  The  extent 
of  the  auditor's  assessment  can  vary  from  one  audit 
to  another  and  within  different  elements  of  an 
entity's  internal  control  structure,  based  on  both  the 
auditor's  understanding  of  that  internal  control 
structure  and  the  auditor's  judgment  about  alterna- 
tive forms  of  audit  evidence.  That  understanding 
and  assessment  by  itself  is  not  sufficient  for  expres- 
sing an  opinion  about  the  design  and  operation  of 
the  entity's  internal  control  structure  as  a  whole  or 
of  its  specific  elements. 

19.  The  auditor  may  limit  the  consideration  of  internal 
control  structure  for  a  number  of  reasons.  These 
include: 

a.  An  adequate  internal  control  structure  does  not 
exist  for  reliance  thereon  because  of  the  small  size 
of  the  entity. 

b.  The  auditor  may  conclude  that  it  would  be  ineffi- 
cient to  evaluate  the  effectiveness  of  internal  con- 
trol structure  policies  and  procedures  and  that  the 
audit  can  be  conducted  more  efficiently  by 
expanding  substantive  audit  tests,  thus  placing 
very  little  reliance  on  the  internal  control  structure. 

c.  The  existing  internal  control  structure  may  con- 
tain so  many  weaknesses  that  the  auditor  has  no 
choice  but  to  rely  on  substantive  testing,  thus  virtu- 
ally ignoring  the  internal  control  structure. 
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d.  The  objectives  of  a  financial  related  audit  did  not 
require  an  understanding  or  assessment  of  the 
internal  control  structure. 

20.    The  above  circumstances  should  be  documented  in 
the  working  papers  and  included  in  the  report  on 
internal  control. 

21     In  identifying  the  significant  internal  controls,  the 
report  should  list  those  controls  identified  by  the 
auditor. 

22.    The  following  are  examples  of  different  ways  in 
which  the  internal  control  structure  might  be  classi- 
fied. Auditors  may  modify  these  examples  or  use 
other  classifications  as  appropriate  for  the  particu- 
lar circumstances  on  which  they  are  reporting. 


Cycles  of  the  entity's  activity 

Treasury  or  financing 
Revenue/receipts 
Purchases/disbursements 
External  financial  reporting 

Financial  statement  captions 

Cash  and  cash  equivalents 

Receivables 

Inventory 

Property  and  equipment 

Payables  and  accrued  liabilities 

Debt 

Fund  balance 

(continued) 
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Accounting  applications 

Billings 
Receivables 
Cash  receipts 
Purchasing  and  receiving 
Accounts  payable 
Cash  disbursements 
Payroll 

Inventory  control 
Property  and  equipment 
General  ledger 

Controls  used  in  administering  compliance  with  laws 
and  regulations 

General  controls 
Specific  controls 


23.  In  reporting  reportable  conditions,  the  auditors 
should  identify  those  that  are  material  weaknesses. 
The  auditors  should  also  follow  report  content  stan- 
dards, as  appropriate,  for  objectives,  scope  and 
methodology,  audit  results,  and  views  of  responsi- 
ble officials,  and  the  report  presentation  standards, 
discussed  in  chapter  7.9 

24.  The  aicpa's  statements  on  auditing  standards,  and 
interpretations  thereof,  give  guidance  on  reporting 
conditions  that  relate  to  an  entity's  internal  control 
structure  observed  during  an  audit.  The  supplemen- 
tal requirements  for  reporting  on  internal  controls 
stated  in  the  above  standard  should  also  be 
included  in  the  report. 


9See  footnote  7  on  page  6-4. 
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25.    Nonreportable  conditions  in  an  audited  entity's 
internal  control  structure  not  included  in  the 
required  reports,  should  be  separately  communi- 
cated to  the  audited  entity,  preferably  in  writing. 
Such  control  structure  conditions  when  communi- 
cated in  a  management  letter  to  top  management 
should  be  referred  to  in  the  report  on  internal  con- 
trols. All  communications  should  be  documented  in 
the  working  papers. 


Reporting  on 
Financial 
Related  Audits 


26.    The  fourth  supplemental  reporting  standard  for 
government  financial  audits  is: 

Written  audit  reports  are  to  be  prepared  giving 
the  results  of  each  financial  related  audit. 


27.    The  aicpa  reporting  standards,  to  the  extent  that 
they  are  relevant,  also  apply  to  financial  related 
audits.  However,  if  the  aicpa  reporting  standards 
are  not  relevant,  the  reporting  standards  in  chapter 
7  should  be  followed  by  the  auditor  in  reporting  on 
financial  related  audits  to  the  extent  appropriate. 


Privileged  and 

Confidential 

Information 


28.  The  fifth  supplemental  reporting  standard  for  gov- 
ernment financial  audits  is: 

If  certain  information  is  prohibited  from  general 
disclosure,  the  report  should  state  the  nature  of 
the  information  omitted  and  the  requirement 
that  makes  the  omission  necessary. 

29.  Certain  information  may  be  prohibited  from  general 
disclosure  by  federal,  state,  or  local  laws  or  regula- 
tions. Such  information  may  be  provided  on  a  need- 
to-know  basis  only  to  persons  authorized  by  law  or 
regulation  to  receive  it. 
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30.  If  the  auditors  are  prohibited  by  such  requirements 
from  including  pertinent  data  in  the  report,  they 
should  state  the  nature  of  the  information  omitted 
and  the  requirement  that  makes  the  omission  neces- 
sary. The  auditors  should  obtain  assurance  that  a 
valid  requirement  for  the  omission  exists  and, 
where  appropriate,  consult  with  legal  counsel. 

31.  Auditors  should  consult  with  appropriate  legal 
counsel  before  releasing  reports  which  refer  to  the 
fact  that  illegal  acts  or  indications  of  such  acts  were 
omitted  from  reports.1 " 


Report 
Distribution 


32.  The  sixth  supplemental  reporting  standard  for  gov- 
ernment financial  audits  is: 

Written  audit  reports  are  to  be  submitted  by  the 
audit  organization  to  the  appropriate  officials  of 
the  organization  audited  and  to  the  appropriate 
officials  of  the  organizations  requiring  or 
arranging  for  the  audits,  including  external 
funding  organizations,  unless  legal  restrictions, 
ethical  considerations,  or  other  arrangements 
prevent  it.  Copies  of  the  reports  should  also  be 
sent  to  other  officials  who  have  legal  oversight 
authority  or  who  may  be  responsible  for  taking 
action  and  to  others  authorized  to  receive  such 
reports.  Unless  restricted  by  law  or  regulation, 
copies  should  be  made  available  for  public 
inspection.11 

33.  Audit  reports  should  be  distributed  in  a  timely  man- 
ner to  as  many  interested  officials  as  is  practicable. 
In  some  cases,  the  subject  of  the  audit  may  involve 
material  that  is  classified  for  security  purposes  or 
cannot  be  released  to  particular  parties  or  to  the 


10See  paragraph  16  on  page  5-6. 

1  lSee  the  Single  Audit  Act  of  1984  (31  U.S.C.  7502  (f))  and  section 
13  (0  of  OMB  Circular  A-l  28  for  the  distribution  of  reports  on 
single  audits  of  state  and  local  governments. 
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public  for  other  valid  reasons.  Generally,  however, 
the  report  should  be  distributed  to  officials  inter- 
ested in  the  results.  Such  officials  include  those  des- 
ignated by  law  or  regulation  to  receive  such  reports, 
those  responsible  for  taking  action,  legislators,  and 
those  of  other  levels  of  government  that  have  pro- 
vided funds  to  the  audited  entity. 

34.  When  public  accountants  are  engaged,  the  engaging 
organization  must  ensure  that  appropriate  distribu- 
tion is  made.  If  the  public  accountants  are  to  make 
the  distribution,  the  engagement  agreement  should 
indicate  what  officials  or  organizations  should 
receive  the  report. 

35.  Internal  auditors  should  follow  their  entity's  own 
arrangements  and  statutory  requirements  for  distri- 
bution. Usually,  they  report  to  their  entity's  top 
management  and  the  entity's  management  is 
responsible  for  distribution  of  the  report. 

36.  The  auditor's  report  on  the  financial  audit,  the 
report  on  compliance,  and  the  report  on  internal 
control,  if  separate  reports,  should  normally  be 
bound  together  so  that  the  three  reports  are  issued 
together  in  one  bound  document.  If  the  three 
reports  are  not  issued  together  in  one  bound  docu- 
ment, it  is  recommended  that  the  auditor's  report  on 
the  financial  audit  include  a  statement  that  reports 
on  compliance  and  internal  control  were  also  issued. 
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Purpose 


l.    This  chapter  prescribes  standards  of  field  work  for 
government  performance  audits. 


Planning 


2.  The  first  field  work  standard  for  government  per- 
formance audits  is: 

Work  is  to  be  adequately  planned. 

3.  This  standard  places  responsibility  on  the  auditor 
or  audit  organization  to  thoroughly  plan  an  audit. 
This  includes  defining  the  audit  objectives  and  plan- 
ning how  they  can  be  attained  while  establishing  a 
balance  between  audit  scope,  time  frames,  and 
staff -days  to  be  spent  to  ensure  optimum  use  of 
audit  resources.  The  details  of  the  plan  for  the  audit 
should  be  included  in  the  audit  program. 

4.  Planning  is  important  to  ensure  that  the  audit 
results  will  satisfy  the  objectives  of  the  audit.  Ade- 
quate planning  is  especially  important  in  perform- 
ance audits  because  the  methodology  and 
implementing  steps  and  procedures  employed  in 
such  audits  are  varied  and  complex. 

5.  Planning  is  also  important  in  intergovernmental 
auditing  because,  in  many  instances,  the  audit  work 
conducted  at  one  level  of  government  should  be 
coordinated  with  other  audit  work  conducted  at  the 
same  level  or  different  levels. 


Considerations 
in  Planning 


6.    The  information  needed  by  the  auditor  to  plan  an 
audit  varies  with  the  audit  objectives  and  the  entity 
to  be  audited.  In  many  instances,  an  audit  survey  of 
the  entity  may  be  made  before  preparing  a  plan  for 
conducting  the  field  work.  The  survey  is  an  effec- 
tive method  to  help  identify  specific  audit  areas  and 
to  obtain  information  for  use  in  planning.  It  is  a  pro- 
cess for  quickly  gathering  information,  without 
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detailed  verification,  on  the  entity's  organization, 
programs,  activities,  and  functions.1 

7.  A  survey  will  provide  information  about  the  key 
systems  and  procedures  used  for  managing  finances 
and  operations  and  for  evaluating  and  reporting 
performance.  It  will  also  provide  information  about 
the  size  and  scope  of  the  entity's  activities  as  well 
as  areas  in  which  there  may  be  internal  control 
weaknesses,  uneconomical  or  inefficient  operations, 
lack  of  effective  goal  achievement,  or  lack  of  com- 
pliance with  laws  and  regulations.  However,  tests  to 
determine  the  significance  of  such  matters  are  gen- 
erally conducted  in  the  detailed  audit  work  as  speci- 
fied in  the  audit  programs. 

8.  Adequate  planning  should  include  consideration  of: 

a.  Audit  objectives,  scope,  and  methodology. 

b.  Criteria  for  assessing  performance  (where 
applicable). 

c.  Coordination  with  other  government  auditors, 
when  appropriate,  including  work  already  con- 
ducted and  other  work  that  may  be  intended. 

d.  Skill  and  knowledge  of  the  personnel  to  staff  the 
assignment  and  the  use  of  consultants,  experts,  and 
specialists. 

e.  Compliance  with  laws  and  regulations  and  poten- 
tial abuse  and  illegal  acts.  (See  paragraph  30 
below.) 

f.  Assessment  of  internal  controls.  (See  paragraph 
49  below.) 


1  The  concepts  and  procedures  of  the  audit  survey  are  discussed  in 
GAO  publication  entitled,  The  Audit  Survey  -  A  Key  Step  in  Audit- 
ing Government  Programs. 
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g.  Materiality  and/or  significance  and  audit  risk. 
(See  chapter  3,  paragraph  33.) 


Audit  Objectives, 
Scope,  and 
Methodology 


9.    Determining  and  explaining  the  rationale  for  select- 
ing an  audit's  objectives,  scope,  and  methodology 
require  logical  and  systematic  thinking. 

10.    The  first  step  in  planning  a  performance  audit  is  to 
define  carefully  the  audit  objectives.  The  statement 
of  audit  objectives  should  clearly  articulate  what 
the  audit  is  to  accomplish.  This  means  phrasing  the 
objectives  to  identify  the  audit  subject  and  the  per- 
formance aspect  to  be  included.  Because  it  is  rare 
for  one  audit  to  cover  all  aspects  of  performance,  it 
is  important  to  know,  in  planning,  what  aspect  or 
aspects  are  going  to  be  included.  This  is  critical  in 
establishing  the  audit  boundaries. 

n.    Audit  findings  have  often  been  regarded  as  contain- 
ing the  elements  of  criteria,  condition,  and  effect, 
plus  cause  when  problems  are  found.  Recommenda- 
tions and  conclusions  are  added,  as  appropriate,  in 
reporting.  However,  the  elements  needed  for  a  com- 
plete finding  and  report  depend  on  the  objectives  of 
the  audit.  Thus,  the  objectives  should  be  phrased  to 
identify  those  finding  and  reporting  elements  that 
are  to  be  developed.  For  example,  the  auditor  may 
have  as  an  objective  to  ascertain  the  level  of  per- 
formance being  achieved;  or  to  go  a  step  farther  and 
determine  if  that  level  of  performance  is  satisfac- 
tory. If  not  satisfactory,  the  auditor  may  or  may  not 
have  as  an  objective,  identifying  the  cause  and  mak- 
ing recommendations.  Knowing  what  finding  and 
reporting  elements  are  to  be  developed  is  critical  in 
planning  so  as  to  gather  the  evidence  necessary  to 
support  the  finding  elements  that  may  be  required. 

12.    The  objectives  of  an  audit  extend  throughout  every 
phase  of  the  audit,  from  the  selection  of  scope, 
methodology,  and  staff,  to  the  conduct  of  the  audit, 
and  the  timing  and  nature  of  reports.  Time  invested 
in  determining  an  audit's  objectives  is  usually  time 
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well  spent  because  an  audit  with  clear  objectives  is 
unlikely  to  result  in  wasted  resources,  delays,  and 
poor  quality  reports.  In  analyzing  possible  audit 
objectives,  auditors  need  to  consider  all  that  they 
know  about  the  significance  of  an  issue,  the  contri- 
bution they  can  make,  and  the  availability  of  data 
and  resources. 

13.  Decisions  about  the  scope  of  audit  work  necessary 
to  achieve  the  audit  objectives  are  based  on  such 
factors  as,  the  availability  and  recency  of  data,  and 
the  ease  and  appropriateness  with  which  particular 
analytic  techniques  could  be  applied.  Questions  to 
be  considered  include:  What  period  should  be  con- 
sidered? Will  the  results  be  projected?  What  level  of 
validity  is  needed  in  documenting  the  existence  of  a 
problem  and  its  cause?  What  comparisons  will  be 
made? 

14.  "Methodology"  refers  to  the  process  used  to  gather 
and  analyze  data  and  to  reach  conclusions  and  rec- 
ommendations. The  methodology  selected  needs  to 
provide  evidence  that  will  achieve  the  objectives  of 
the  audit. 


Criteria 


15.    When  criteria  are  needed  to  evaluate  matters  sub- 
ject to  audit,  the  audit  plan  should,  where  possible, 
state  the  criteria  to  be  used.  Criteria  are  standards 
against  which  the  adequacy  of  performance  can  be 
assessed.  In  selecting  criteria,  auditors  have  a 
responsibility  to  use  only  criteria  that  are  suitable. 
Suitable  criteria  are  those  that  are  relevant  to  the 
matters  being  audited  and  are  reasonable  and 
attainable. 


Coordination 


16.    In  government  auditing,  a  central  audit  agency, 

such  as  a  federal  or  state  audit  organization,  may  be 
responsible  for  audits  involving  work  by  its  field 
office  staff  at  several  different  locations.  The  cen- 
tral agency  should  carefully  plan  these  audits  to 


Page  6-4 


Chapter  6 

Field  Work  Standards  for 

Pert orman  ce  Audita 


ensure  that  they  will  be  conducted  effectively  and 
efficiently. 

17.  Planning  for  audits  should  be  tailored  to  the  specific 
audit  objectives.  Ordinarily  the  central  audit  agency 
should  specify  the  compliance  requirements  to  be 
considered  by  the  auditor,  the  aspects  of  economy 
and  efficiency  to  be  included  in  the  audit,  and  the 
program  goals  and  objectives,  and  measurement  cri- 
teria to  be  used.  Unless  such  planning  is  carefully 
done  and  communicated  to  the  participating  staffs, 
the  audit  results  may  not  meet  the  needs  and  expec- 
tations of  the  central  audit  agency.  Unplanned  audit 
effort  will  make  it  difficult  to  compare  and  consoli- 
date the  results  from  various  locations. 

18.  An  audit,  or  certain  aspects  of  an  audit  to  be  con- 
ducted at  several  locations  by  different  staff  can  be 
planned  more  efficiently  and  economically  by  a  des- 
ignated audit  organization.  For  example,  research- 
ing the  program  laws  and  regulations  and 
establishing  clear  and  concise  audit  objectives  are 
time-consuming.  To  have  each  participating  staff  do 
this  would  be  duplicative  and  more  costly  than  nec- 
essary. Some  audits  require  even  closer  coordina- 
tion because  a  given  event  may  be  audited  at  more 
than  one  location  by  different  staffs.  The  prepara- 
tion of  audit  programs  for  such  audits  is  an  integral 
part  of  the  standard  for  planning. 

19.  In  many  instances,  audits  of  the  same  organizations, 
programs,  activities,  or  functions  may  be  required 
by  federal,  state,  and  local  laws,  regulations,  and 
ordinances.  When  this  situation  exists,  to  avoid 
duplicate  efforts,  auditors  in  planning  their  work 
should  coordinate  with  other  government  auditors 
to  determine  whether  they  have  any  audit  work 
planned,  in  process,  or  completed  that  may  be  used 
to  satisfy  some  or  all  of  their  planned  work. 
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Personnel  20-    Staff  planning  should  include: 

a.  Assigning  staff  with  the  appropriate  skills  and 
knowledge  for  the  job. 

b.  Assigning  an  adequate  number  of  experienced 
staff  and  supervisors  to  the  audit.  Consultants 
should  be  used  when  necessary. 

c.  Providing  for  on-the-job  training  of  staff. 


Audit  Program         21-     Written  audit  programs  should  be  prepared  for 

each  audit  and  are  essential  to  conducting  audits 
efficiently  and  effectively.  Audit  programs  provide: 

a.  A  description  of  the  methodology  and  suggested 
audit  steps  and  procedures  to  be  conducted  to 
accomplish  the  audit  objectives. 

b.  A  systematic  basis  for  assigning  work  to  supervi- 
sors and  staff. 

c.  The  basis  for  a  summary  record  of  work. 

22.  Written  audit  programs  should  not  be  used  merely 
as  a  checklist  of  steps  to  be  conducted.  Effective 
work  on  performance  audits  requires  that  the  staff 
understand  the  objectives  of  the  audit  and  use  their 
own  initiative  in  determining  the  appropriateness  of 
steps  in  the  audit  program  and  in  assessing  the 
results  of  the  work. 

23.  Audit  programs  should  generally  include  the  follow- 
ing information: 

a.  Introduction  and  background:  Information  should 
be  provided  about  the  legal  authority  for  the 
audited  organization,  program,  activity,  or  function; 
its  history  and  current  objectives;  its  principal  loca- 
tions; and  similar  information  needed  by  the  auditor 
to  understand  and  carry  out  the  audit  program. 
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b.  Objectives  of  the  audit:  The  objectives  should  be 
clearly  stated. 

c.  Scope  of  the  audit:  The  scope  should  be  clearly 
described. 

d.  Audit  methods:  The  methodology  should  be 
clearly  described,  and  for  most  audits,  it  is  desirable 
to  include  suggested  steps  and  procedures,  and  sam- 
pling plans  for  the  auditors  to  follow.  For  coordi- 
nated audits,  the  audit  organization  planning  the 
work  should  ordinarily  suggest  the  audit  methods 
to  be  followed  in  the  audit  to  be  sure  that  the  data 
obtained  from  participating  locations  will  be  com- 
parable. However,  this  should  be  done  in  a  manner 
that  does  not  restrict  the  auditor's  professional 
judgment. 

e.  Definition  of  terms:  Any  known  unique  terms 
used  by  the  audited  entity  should  be  defined  or 
explained. 

f.  Special  instructions:  The  auditors  should  clearly 
understand  and  reach  early  agreement  on  the 
responsibilities  in  each  audit.  This  agreement  is 
especially  important  when  the  work  is  to  be 
directed  by  a  central  audit  organization  with  work 
to  be  conducted  at  several  different  locations.  This 
section  of  the  program  may  be  used  to  list  the 
responsibilities  of  each  audit  organization,  such  as 
preparing  audit  programs,  conducting  audit  work, 
supervising  audit  work,  drafting  reports,  handling 
auditee  comments,  and  processing  the  final  report. 

g.  Report:  The  audit  program  should  set  forth  the 
general  format  (if  not  included  in  organization  audit 
policy  and  procedures)  to  be  followed  in  the  audit 
report  and  cite,  to  the  extent  possible,  the  types  of 
information  to  be  in  it. 
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SllDervision  24*    ^ne  s^0™*  ^ie^  work  standard  for  government 

^  performance  audits  is: 

Staff  are  to  be  properly  supervised. 

25.  This  standard  places  responsibility  on  the  auditor 
and  audit  organization  for  seeing  that  staff  who  are 
involved  in  accomplishing  the  objectives  of  the 
audit  receive  appropriate  guidance  and  supervision 
to  ensure  that  the  audit  work  is  properly  conducted, 
the  audit  objectives  are  accomplished,  and  staff  are 
provided  effective  on-the-job  training.  External  con- 
sultants and  specialists  also  should  be  given  appro- 
priate guidance. 

26.  The  most  effective  way  to  ensure  the  quality  and 
expedite  the  progress  of  an  assignment  is  by  exer- 
cising proper  supervision  from  the  start  of  the  plan- 
ning to  the  completion  of  audit  work  and  reporting. 
Supervision  adds  seasoned  judgment  to  the  work 
performed  by  less  experienced  staff  and  provides 
necessary  training  for  them. 

27.  Assigning  and  using  staff  is  important  to  satisfac- 
tory achievement  of  objectives.  Since  skills  and 
knowledge  vary  among  auditors,  work  assignments 
must  be  commensurate  with  abilities. 

28.  Supervisors  should  satisfy  themselves  that  staff 
members  clearly  understand  their  assigned  tasks 
before  starting  the  work.  Staff  should  be  informed 
of  not  only  what  work  they  are  to  do  and  how  they 
are  to  proceed  but  also  why  the  work  is  to  be  con- 
ducted and  what  it  is  expected  to  accomplish.  With 
experienced  staff,  the  supervisors'  role  may  be 
more  general.  They  may  outline  the  scope  of  the 
work  and  leave  details  to  assistants.  With  a  less 
experienced  staff,  the  supervisor  may  have  to  per 
form  many  details  and  specify  to  the  staff  how  to 
conduct  specific  data  gathering  and  analysis 
techniques. 
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29.    Supervisory  reviews  of  audit  work  and  the  report 
should  be  timely  and  determine  whether  (1)  con- 
formance with  audit  standards  is  obtained,  (2)  the 
audit  programs  are  followed,  unless  deviation  is  jus- 
tified and  authorized,  (3)  the  audit  work  has  been 
conducted  with  due  professional  care,  (4)  the  work- 
ing papers  adequately  support  findings  and  conclu- 
sions and  provide  sufficient  data  to  prepare  a 
meaningful  report,  and  (5)  the  audit  objectives  are 
met.  Supervisory  reviews  of  the  work  conducted 
should  be  documented  in  the  working  papers. 


Legal  and 

Regulatory 

Requirements 


30.  The  third  field  work  standard  for  government  per- 
formance audits  is: 

An  assessment  is  to  be  made  of  compliance  with 
applicable  requirements  of  laws  and  regulations 
when  necessary  to  satisfy  the  audit  objectives. 

31.  In  government  auditing,  compliance  with  laws  and 
regulations  is  important  because  government  orga- 
nizations, programs,  services,  activities,  and  func- 
tions are  usually  created  by  law  and  are  subject  to 
more  specific  rules  and  regulations  than  the  private 
sector.  For  example,  what  is  to  be  done,  who  is  to 
do  it,  the  goals  and  objectives  to  be  achieved,  the 
population  to  be  served,  and  how  much  can  be 
spent  on  what  are  usually  set  forth  in  laws  and 
regulations. 

32.  The  need  to  assess  compliance  with  requirements  of 
laws  and  regulations,  and  the  nature  of  that  assess- 
ment, varies  with  the  objectives  of  the  audit.  Where 
assessment  of  compliance  is  called  for,  this  stand- 
ard places  responsibility  on  the  auditor  to  design 
steps  and  procedures  that  will  provide  reasonable 
assurance  that  the  audited  entity  has  adhered  to 
the  requirements  of  laws  and  regulations  applicable 
to  the  audit  which,  if  not  followed,  could  signifi- 
cantly affect  the  audit  results. 
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33.  Management  is  responsible  for  establishing  an 
effective  system  of  internal  control  to  ensure  com- 
pliance with  laws  and  regulations.  In  designing 
steps  and  procedures  to  assess  compliance,  auditors 
should  consider  the  entity's  internal  controls. 

34.  The  nature  of  requirements  of  laws  and  regulations 
that  the  auditor  might  assess  are  illustrated  below. 

a.  Economy  and  efficiency:  Compliance  with  laws 
and  regulations  that  could  significantly  affect  the 
acquisition,  protection,  and  use  of  the  entity's 
resources,  and  the  quantity,  quality,  timeliness,  and 
cost  of  the  products  and  services  it  produces  and 
delivers. 

b.  Program:  Compliance  with  laws  and  regulations 
pertaining  to  the  objectives  of  the  entity's  pro- 
grams, activities,  and  functions;  the  manner  in 
which  programs  and  services  are  to  be  delivered; 
the  population  a  program  or  service  is  to  serve;  and 
whether  the  programs,  activities,  and  functions  are 
being  carried  out  in  conformity  with  these  laws  and 
regulations. 

35.  Auditors  are  responsible  for  determining  which 
requirements  of  laws  and  regulations  are  to  be  con- 
sidered in  the  audit.  This  responsibility  requires 
that  those  planning  the  audit  be  knowledgeable  of 
the  compliance  requirements  that  apply  to  the  sub- 
ject under  audit.  Because  the  laws  and  regulations 
that  may  apply  to  a  specific  audit  are  often  numer- 
ous, the  auditors  need  to  exercise  professional  judg- 
ment in  determining  those  laws  and  regulations  that 
might  have  a  significant  impact  on  the  audit 
objectives. 

36.  A  variety  of  sources  exist  for  information  on 
requirements  of  laws  and  regulations.  The  audited 
entity  is  expected  to  know  the  applicable  require- 
ments, and  thus  is  a  good  first  source.  When  fund- 
ing from  another  level  of  government  is  involved 
and  the  source  is  known,  auditors  can  obtain  and/or 
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corroborate  information  about  the  applicable 
requirements  from  the  funding  entity.  Auditors 
should  consult  with  appropriate  legal  counsel  when 
questions  arise  concerning  application  and  the 
interpretation  of  laws  and  regulations. 

37.  Where  an  assessment  of  compliance  with  laws  and 
regulations  is  required: 

Auditors  should  design  the  audit  to  provide  rea- 
sonable assurance  of  detecting  abuse  or  illegal 
acts  that  could  significantly  affect  the  audit 
objectives. 

38.  In  conducting  audits  in  accordance  with  this  stan- 
dard, the  auditors  choose  and  perform  audit  steps 
and  procedures  that,  in  their  professional  judgment, 
are  appropriate  in  the  circumstances  to  achieve  the 
audit  objectives.  These  audit  steps  and  procedures 
are  designed  to  obtain  sufficient,  competent,  and 
relevant  evidence  that  will  provide  a  reasonable 
basis  for  their  judgments  and  conclusions  regarding 
the  audit  objectives. 

39.  This  standard  places  responsibility  on  the  auditor 
when  assessing  compliance  with  laws  and  regula- 
tions to: 

a.  Assess,  for  each  applicable  compliance  require- 
ment, the  risk  that  abuse  and  illegal  acts  could 
occur. 

b.  Based  on  that  assessment,  design  steps  and  pro- 
cedures to  provide  reasonable  assurance  of 
detecting  abuse  or  illegal  acts. 

40.  When  audit  steps  and  procedures  indicate  that 
abuse  or  illegal  acts  have  or  may  have  occurred,  the 
auditor  needs  to  determine  the  extent  to  which 
these  acts  significantly  affect  the  audit  results. 

41.  Detecting  noncompliance  resulting  from  illegal  acts 
is  generally  difficult.  Doing  so  commonly  requires 
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special  steps,  and  auditors  are  expected  to  devise 
and  apply  such  steps  as  may  be  effective.  Because  a 
sound  internal  control  structure  can  be  effective  in 
ensuring  compliance,  an  assessment  of  the  control 
structure  is  generally  useful. 

42.  In  all  performance  audits: 

Auditors  should  be  alert  to  situations  or  trans- 
actions that  could  be  indicative  of  abuse  or  ille- 
gal acts. 

43.  When  information  comes  to  the  auditor's  attention 
(through  audit  procedures,  tips,  or  other  means) 
indicating  that  abuse  or  illegal  acts  may  have 
occurred,  the  auditor  should  consider  the  potential 
impact  of  these  acts  on  the  audit  results.  If  these 
acts  could  significantly  affect  the  audit  results,  the 
auditor  should  extend  the  audit  steps  and  proce- 
dures, as  necessary  (a)  to  determine  whether  the 
acts  occurred  and  (b)  if  so,  to  determine  the  extent 
to  which  these  acts  significantly  affect  the  audit 
results. 


Due  Care  44.    When  an  audit  is  conducted  under  contract  and  the 

Concerning  contract  does  not  permit  the  auditor  to  unilaterally 

Illegal  Acts  extend  steps  and  procedures,  the  auditor  should 

&  obtain  written  approval  to  perform  the  necessary 

additional  work.  If  such  approval  is  not  given  to  the 
auditor,  a  scope  impairment  generally  exists  which 
should  be  stated  in  the  auditor's  report. 

45.    Auditors  should  exercise  due  professional  care  and 
caution  in  pursuing  indications  of  illegal  acts  so  as 
not  to  interfere  with  potential  future  investigations 
and/or  legal  proceedings.  Due  care  would  include 
consulting  appropriate  legal  counsel  and/or  the 
applicable  law  enforcement  organization,  where 
appropriate,  before  proceeding. 
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46.  Circumstances  may  exist  in  which  laws,  regulations, 
or  policy  require  auditors  to  promptly  report  indica- 
tions of  illegal  acts  to  law  enforcement  or  investiga- 
tory authorities  before  extending  audit  steps  and 
procedures.  The  auditor  may  also  be  required  to 
withdraw  from,  or  defer  further  work  on,  the  audit 
or  a  portion  of  the  audit  in  order  not  to  interfere 
with  an  investigation.  However,  the  auditor  should 
consider  whether  this  would  restrict  the  completion 
of  the  remaining  portion  of  the  audit  or  interfere 
with  the  auditor's  ability  to  form  objective  opinions 
and  conclusions.  If  it  restricts  or  interferes,  the 
auditor  should  terminate  the  audit  or  discontinue 
further  action  until  completion  of  the  investigation. 
(See  reporting  requirements  in  chapter  7.) 

47.  Most  auditors  are  not  trained  to  conduct  investiga- 
tions of  certain  types  of  illegal  acts  which  are  the 
responsibility  of  the  investigator  or  law  enforce- 
ment authorities.  However,  auditors  are  responsible 
for  being  aware  of  the  characteristics  and  types  of 
vulnerabilities  and  potential  illegal  acts  associated 
with  the  area  being  audited  in  order  to  be  able  to 
identify  indications  that  these  acts  may  have 
occurred. 

48.  An  audit  made  in  accordance  with  the  standards  in 
this  statement  will  not  guarantee  the  discovery  of 
all  abuse  or  illegal  acts.  Nor  does  the  subsequent 
discovery  of  abuse  or  illegal  acts  committed  during 
the  audit  period  necessarily  mean  the  auditors'  per- 
formance was  inadequate,  provided  the  audit  was 
made  in  accordance  with  the  standards  in  this 
statement. 


Internal 
Control 


49.     The  fourth  field  work  standard  for  government  per- 
formance audits  is: 

An  assessment  should  be  made  of  applicable 
internal  controls  when  necessary  to  satisfy  the 
audit  objectives. 
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so     Management  is  responsible  for  establishing  an 
effective  system  of  internal  controls.  The  lack  of 
administrative  continuity  in  government  units 
because  of  continuing  changes  in  elected  legislative 
bodies  and  in  administrative  organizations  increases 
the  need  for  an  effective  internal  control  system. 

51.  Internal  controls  include  the  plan  of  organization 
and  methods  and  procedures  adopted  by  manage- 
ment to  ensure  that  its  goals  and  objectives  are  met; 
that  resources  are  used  consistent  with  laws,  regu- 
lations, and  policies;  that  resources  are  safeguarded 
against  waste,  loss,  and  misuse;  and  that  reliable 
data  are  obtained,  maintained,  and  fairly  disclosed 
in  reports. 

52.  The  need  to  assess  internal  controls  and  the  focus  of 
that  assessment  varies  with  the  objectives  of  the 
audit. 

a.  An  assessment  is  required  in  audits  having  as 
objectives  the  assessment  of  the  adequacy  of  partic- 
ular internal  controls.  Here,  the  auditor  should 
design  steps  and  procedures  to  assess  the  effective- 
ness of  the  prescribed  control  procedures  or  actual 
control  practices. 

b.  An  assessment  of  internal  controls  is  a  natural 
adjunct  in  audits  having  as  their  objectives  an 
assessment  of  the  adequacy  of  the  process  (e.g., 
procedures  and  practices)  for  carrying  out  a  partic- 
ular program,  service,  activity,  or  function.  Here, 
the  auditor  should  design  steps  and  procedures  to 
determine  if  controls  needed  in  the  process  exist 
and  if  the  existing  controls  are  adequate  to  achieve 
the  desired  objectives. 

c.  An  assessment  may  be  necessary  in  audits  having 
as  objectives  deterniining  the  underlying  cause  of 
unsatisfactory  performance  (e.g.,  lack  of  improve- 
ment achieved  by  recently  installed  automation 
intended  to  increase  productivity).  Here,  if  the 
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unsatisfactory  performance  could  occur  from  weak- 
nesses in  internal  controls,  the  auditor  should 
design  steps  and  procedures  to  assess  the  adequacy 
of  those  specific  controls  that  if  weak  could  cause 
the  unsatisfactory  performance. 

53.  The  focus  of  the  assessment  of  internal  controls 
varies  with  the  objective  of  the  audit  being 
conducted. 

a.  Economy  and  efficiency  audits:  The  auditors  may 
assess  those  policies,  procedures,  practices,  and 
controls  applicable  to  the  programs,  functions,  and 
activities,  under  audit  to  the  extent  necessary,  as 
determined  by  the  audit  objectives. 

b.  Program  audits:  The  auditors  may  assess  those 
policies,  procedures,  practices,  and  controls  which 
specifically  bear  on  the  attainment  of  the  goals  and 
objectives  specified  by  the  law  or  regulations  for 
the  organization,  program,  activity,  or  function 
under  audit  to  the  extent  necessary,  as  determined 
by  the  audit  objectives. 

54.  Auditors  may  be  required  or  contracted  to  audit  or 
assess  particular  internal  controls.  Such  assess- 
ments should  be  made  in  accordance  with  the  stan- 
dards in  this  statement.2 

55.  Internal  auditing  is  an  important  part  of  internal 
control,  and  the  auditors  should  consider  this  in 
conducting  the  audit.  Where  an  assessment  of  inter- 
nal controls  is  called  for,  external  auditors  should 
consider  the  extent  to  which  the  work  of  the  inter- 
nal auditors  can  be  relied  upon  to  help  provide 
reasonable  assurance  that  internal  control  is  func- 
tioning properly  and  to  prevent  duplication  of 
effort.3 


2Examples  include  the  Federal  Managers'  Financial  Integrity  Act 
of  1982  (Public  Law  97-265)  and  the  laws  of  several  states. 

3See  chapter  3,  paragraph  37  for  guidance  the  auditor  should  fol- 
low when  relying  on  the  work  of  others. 


Page  6-15 


Chapter6 

Field  Work  Standards  for 

Performance  Audits 


56.    In  view  of  the  wide  range  in  the  size  and  nature  of 
government  organizations,  programs,  activities,  and 
functions  and  in  view  of  their  organizational  struc- 
tures and  operating  methods,  no  single  pattern  for 
internal  audit  and  review  activities  can  be  specified. 
Many  government  entities  have  these  activities 
identified  by  other  names,  such  as  inspection, 
appraisal,  investigation,  organization  and  methods, 
or  management  analysis.  These  activities  assist 
management  by  reviewing  selected  functions. 


Evidence 


57.    The  fifth  field  work  standard  for  government  per- 
formance audits  is: 


Sufficient,  competent,  and  relevant  evidence  is 
to  be  obtained  to  afford  a  reasonable  basis  for 
the  auditors*  judgments  and  conclusions  regard- 
ing the  organization,  program,  activity,  or  func- 
tion under  audit.  A  record  of  the  auditors'  work 
is  to  be  retained  in  the  form  of  working  papers. 
Working  papers  may  include  tapes,  films,  and 
discs. 


Types  of 
Evidence 


58.    Evidence  may  be  categorized  as  (1)  physical,  (2) 
documentary,  (3)  testimonial,  and  (4)  analytical. 

a.  Physical  evidence:  Physical  evidence  is  obtained 
by  direct  inspection  or  observation  of  (1)  activities 
of  people,  (2)  property,  or  (3)  events.  Such  evidence 
may  be  documented  in  the  form  of  memoranda  sum- 
marizing the  matters  inspected  or  observed,  photo- 
graphs, charts,  maps,  or  actual  samples. 

b.  Documentary  evidence:  Documentary  evidence 
consists  of  created  information  such  as  letters,  con- 
tracts, accounting  records,  invoices,  and  manage- 
ment information  on  performance. 

c.  Testimonial  evidence:  Testimonial  evidence  is 
obtained  from  others  through  statements  received 
in  response  to  inquiries  or  through  interviews. 
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Statements  important  to  the  audit  should  be  corrob- 
orated when  possible  with  additional  evidence.  Tes- 
timonial evidence  also  needs  to  be  evaluated  from 
the  standpoint  of  whether  the  individual  may  be 
biased  or  only  have  partial  knowledge  about  the 
area. 

d.  Analytical  evidence:  Analytical  evidence  includes 
computations,  comparisons,  reasoning,  and  separa- 
tion of  information  into  components. 


Tests  of  59-    The  evidence  should  meet  the  basic  tests  of  suf fi- 

Evidence  ciency,  relevance,  and  competence.  The  working 

papers  should  reflect  the  details  of  the  evidence  and 

disclose  how  it  was  obtained. 

a.  Sufficiency:  Sufficiency  is  the  presence  of  enough 
factual  and  convincing  evidence  to  support  the 
auditors'  findings,  conclusions,  and  any  recommen- 
dations. Determining  the  sufficiency  of  evidence 
requires  judgment.  When  appropriate,  statistical 
methods  may  be  used  to  establish  sufficiency. 

b.  Relevance:  Relevance  refers  to  the  relationship  of 
evidence  to  its  use.  The  information  used  to  prove 
or  disprove  an  issue  is  relevant  if  it  has  a  logical, 
sensible  relationship  to  that  issue.  Information  that 
does  not  is  irrelevant  and  therefore  should  not  be 
included  as  evidence. 

c.  Competence:  To  be  competent,  evidence  should  be 
valid  and  reliable.  In  evaluating  the  competence  of 
evidence,  the  auditors  should  carefully  consider 
whether  reasons  exist  to  doubt  its  validity  or  com- 
pleteness. If  so,  the  auditors  should  obtain  addi- 
tional evidence  or  reflect  the  situation  in  the  report. 

60.    The  following  presumptions  are  useful  in  judging 
the  competence  of  evidence.  However,  these  pre- 
sumptions are  not  to  be  considered  sufficient  in 
themselves  to  determine  competence. 
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a.  Evidence  obtained  from  an  independent  source  is 
more  reliable  than  that  secured  from  the  audited 
organization. 

b.  Evidence  developed  under  a  good  system  of  inter- 
nal control  is  more  reliable  than  that  obtained 
where  such  control  is  weak,  unsatisfactory,  or 
nonexistent. 

c.  Evidence  obtained  through  physical  examination, 
observation,  computation,  and  inspection  is  more 
reliable  than  evidence  obtained  indirectly. 

d.  Original  documents  are  more  reliable  than  copies. 

e.  Testimonial  evidence  obtained  under  conditions 
where  persons  may  speak  freely  is  more  credible 
than  testimonial  evidence  obtained  under  compro- 
mising conditions  (e.g.,  where  the  persons  may  be 
intimidated). 

61.    Auditors  should,  when  they  deem  it  useful,  obtain 
from  officials  of  the  audited  entity  written  repre- 
sentations concerning  the  relevance  and  competence 
of  the  evidence  they  obtain. 


Reliability  of 
Evidence  From 
Computer-Based 
Systems 


62.    When  computer-processed  data  are  an  important  or 
integral  part  of  the  audit  and  the  data's  reliability  is 
crucial  to  accomplishing  the  audit  objectives,  audi- 
tors need  to  satisfy  themselves  that  the  data  are  rel- 
evant and  reliable.  This  is  important  regardless  of 
whether  the  data  are  provided  to  the  auditor  or  the 
auditor  independently  extracts  them.  To  determine 
the  reliability  of  the  data,  the  auditors  may  either 
(a)  conduct  a  review  of  the  general  and  application 
controls  in  the  computer-based  systems  including 
tests  as  are  warranted;4  or  (b)  if  the  general  and 


4When  the  reliability  of  a  computer-based  system  is  the  primary 
objective  of  the  audit,  the  auditors  should  conduct  a  review  of  the 
system's  general  and  application  controls. 
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application  controls  are  not  reviewed  or  are  deter- 
mined to  be  unreliable,  conduct  other  tests  and 
procedures. 

63.    When  computer-processed  data  are  used  by  the 

auditor,  or  included  in  the  report,  for  background  or 
informational  purposes  and  are  not  significant  to 
the  audit  results,  citing  the  source  of  the  data  in  the 
report  will  usually  satisfy  the  reporting  standards 
for  accuracy  and  completeness  set  forth  in  this 
statement. 


Review  of  General 
and  Application 
Controls 


64.    In  reviewing  the  general  and  application  controls, 
the  auditor  is  to  consider  the  effectiveness  of  those 
general  controls  relevant  to  the  application  system 
being  reviewed.  General  controls  are  normally 
applicable  to  all  data  processing  being  carried  out 
within  an  installation  and  provide  a  control  envi- 
ronment affecting  the  applications  being  processed. 
Application  controls,  however,  apply  on  an  individ- 
ual basis,  and  may  vary  among  applications. 


Review  of  General 
Controls 


65.  General  controls  include  the  plan  of  organization 
and  methods  and  procedures  that  apply  to  the  over- 
all computer  operations  in  an  agency.  In  reviewing 
the  general  controls,  the  auditor  should  determine 
whether  the  controls  (a)  have  been  designed  accord- 
ing to  management  direction  and  known  legal 
requirements  and  (b)  are  operating  effectively  to 
provide  reliability  of,  and  security  over,  the  data 
being  processed.  The  objectives  and  procedures  fol- 
lowed in  conducting  this  work  are  discussed  in  the 
three  areas  below. 

66.  Organization  and  management  controls:  The  auditor 
should  determine  whether  (a)  there  is  a  clear 
assignment  of  responsibilities  and  accountability 
for  planning,  managing,  and  controlling  the  func- 
tions of  the  data  processing  organization,  (b)  per- 
sonnel are  qualified  and  adequately  trained  and 
supervised,  and  (c)  there  is  proper  separation  of 
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duties.  Such  controls  will  help  ensure  that  the 
organization's  objectives  are  achieved,  and  that 
errors  or  irregular  acts  are  prevented  or  detected. 

67.  Security  controls:  The  auditor  should  determine 
whether  adequate  security  is  provided  over  the 
computer  programs,  data  files,  telecommunications 
network,  and  input  and  output  materials.  These 
controls,  such  as  physical  restrictions  and  the  use  of 
passwords  to  limit  system  access,  help  ensure  that 
only  authorized  persons  are  granted  access  to  the 
computer  system  for  authorized  purposes. 

68.  Systems  software  and  hardware  controls:  Computer 
systems  are  controlled  by  systems  software  such  as 
operating,  data  base  management,  and  program 
library  systems.  Systems  software  and  hardware 
normally  include  built-in  error-checking  features  to 
detect  any  errors  during  processing.  The  auditor 
should  be  aware  (a)  of  the  procedures  used  to 
ensure  that  the  systems  software  and  hardware  are 
functioning  properly,  and  (b)  that  when  errors  are 
detected,  appropriate  and  authorized  corrective 
actions  are  taken.  The  auditor  should  also  be  aware 
of  the  controls  the  systems  software  can  exercise 
over  the  system,  how  these  controls  can  be 
bypassed  or  overridden,  and  how  modifications  to 
the  software  are  controlled. 


Review  of 

Application 

Controls 


69.    Application  controls  are  designed  to  ensure  the 
authority  of  data  origination,  accuracy  of  data 
input,  integrity  of  processing,  and  verification  and 
distribution  of  output.  The  auditor  should  review 
the  application  controls  upon  which  the  auditor  is 
relying  to  assess  their  reliability  to  process  only 
authorized  data  and  to  process  them  promptly, 
accurately,  and  completely.  This  includes  a  review 
of  the  controls  used  to  ensure  that  application  soft- 
ware and  later  modifications  are  authorized  and 
tested  before  implementation.  These  controls  are 
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intended  to  protect  the  integrity  of  the  application 
software. 


Testing  for  Data 
Reliability 


70.    The  degree  of  testing  needed  to  determine  data  reli- 
ability generally  increases  to  the  extent  that  the 
general  or  application  controls  were  determined  to 
be  unreliable  or  were  not  reviewed.  Testing  proce- 
dures could  include: 


a.  Confirming  computer-processed  data  with  inde- 
pendent sources,  such  as  third  parties,  and  knowl- 
edgeable internal  sources,  such  as  regular  users  of 
the  data,  and  suppliers  of  data. 

b.  Comparing  the  data  with  source  documents,  or 
physical  counts  and  inspections. 

c.  Reviewing  agency  test  procedures  and  results, 
and  processing  test  transactions  through  the 
application. 


Working  Papers      w. 


Working  papers  are  the  link  between  field  work  and 
the  audit  report.  They  should  contain  the  evidence 
to  support  the  findings,  judgments,  and  conclusions 
in  the  report.  Audit  organizations  need  to  establish 
policies  and  procedures  for  the  preparation  and 
maintenance  of  working  papers,  including  safe  cus- 
tody and  retention  for  a  time  sufficient  to  satisfy 
legal  and  administrative  requirements. 


72.     As  a  general  guideline,  working  papers  should: 

a.  Contain  a  written  audit  program  cross-referenced 
to  the  working  papers. 

b.  Contain  adequate  indexing  and  cross-referencing, 
schedules,  and  summaries. 

c.  Be  dated  and  signed  by  the  preparer. 
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d.  Be  reviewed  by  a  supervisor.  (That  review 
should  be  documented  in  the  working  papers.) 

e.  Be  complete  and  accurate  to  provide  proper  sup- 
port for  findings,  judgments,  and  conclusions,  and 
to  enable  demonstration  of  the  nature  and  scope  of 
work  conducted. 

f.  Be  understandable  without  oral  explanations. 
They  should  also  be  complete  and  yet  concise.  Any- 
one using  them  should  be  able  to  readily  determine 
their  purpose,  data  sources,  the  nature  and  scope  of 
the  work  conducted,  and  the  preparer's  conclusions. 
Conciseness  is  important,  but  clarity  and  complete- 
ness should  not  be  sacrificed  just  to  save  time  or 
paper. 

g.  Be  as  legible  and  neat  as  practicable.  Otherwise 
the  working  papers  may  lose  their  worth  as 
evidence. 

h.  Be  restricted  to  matters  that  are  significant  and 
relevant  to  the  objectives  of  the  assignment. 

73.    There  are  no  substitutes  for  a  working  understand- 
ing of  the  audit  objectives,  the  reasons  for  con- 
ducting a  specific  task,  and  knowing  how  the  task 
will  satisfy  the  objectives.  This  understanding 
comes  from  well-planned  and  well-organized  work 
programs  and  effective  instructions  by  supervisors. 
The  practice  of  having  all  working  papers  contain 
clear  statements  of  purpose  is  very  helpful  in  ensur- 
ing that  information  accumulated  is  properly 
related  to  audit  objectives  and  reporting. 
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Purpose 


This  chapter  prescribes  standards  of  reporting  for 
government  performance  audits.  The  report  "Con- 
tents" and  "Presentation"  standards  may  also 
apply  for  some  financial  audits. 


Form 


2.    The  first  reporting  standard  for  government  per- 
formance audits  is: 


Written  audit  reports  are  to  be  prepared  commu- 
nicating the  results  of  each  government  audit. 

3.  This  standard  is  not  intended  to  limit  or  prevent 
discussion  of  findings,  judgments,  conclusions,  and 
recommendations  with  persons  who  have  responsi- 
bilities involving  the  area  being  audited.  On  the  con- 
trary, such  discussions  are  encouraged.  However,  a 
written  report  should  be  prepared  regardless  of 
whether  such  discussions  are  held. 

4.  Written  reports  are  necessary  to  (a)  communicate 
the  results  of  audits  to  officials  at  all  levels  of  gov- 
ernment, (b)  make  the  results  less  susceptible  to 
misunderstanding,  (c)  make  the  results  available  for 
public  inspection,  and  (d)  facilitate  follow-up  to 
determine  whether  appropriate  corrective  actions 
have  been  taken. 

5.  When  an  audit  is  terminated  prior  to  completion, 
the  auditor  should  communicate  the  termination  to 
the  auditee  and  other  appropriate  officials,  prefera- 
bly in  writing.  The  auditor  should  also  prepare  a 
memorandum  for  the  record  briefly  summarizing 
the  results  of  the  work  conducted  and  explaining 
why  the  audit  was  terminated. 
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Timeliness 


6.  The  second  reporting  standard  for  government  per- 
formance audits  is: 

Reports  are  to  be  issued  promptly  so  as  to  make 
the  information  available  for  timely  use  by  man- 
agement and  legislative  officials,  and  by  other 
interested  parties. 

7.  To  be  of  maximum  use,  the  report  must  be  timely.  A 
carefully  prepared  report  may  be  of  little  value  to 
decisionmakers  if  it  arrives  too  late.  Therefore,  the 
audit  organization  should  plan  for  the  timely  issu- 
ance of  the  audit  report  and  conduct  the  audit  with 
this  goal  in  mind. 

8.  The  auditors  should  consider  interim  reporting  of 
significant  matters  to  appropriate  officials  during 
the  audit.  Such  communication,  which  may  be  oral 
or  written,  is  not  a  substitute  for  a  final  written 
report,  but  it  does  alert  officials  to  matters  needing 
immediate  attention  and  permits  them  to  take  cor- 
rective action  before  the  final  report  is  completed. 


Report 
Contents 


9. 


The  third  reporting  standard  for  government  per- 
formance audits  covers  the  report  contents. 


Objectives, 
Scope,  and 
Methodology 


10.     The  report  should  include  a  statement  of  the 
audit  objectives  and  a  description  of  the  audit 
scope  and  methodology. 

n.    Knowledge  of  the  objectives  of  the  audit,  and  the 
audit  scope  and  methodology  for  achieving  the 
objectives,  is  needed  by  readers  to  understand  the 
purpose  of  the  audit,  judge  the  merits  of  the  audit 
work  and  what  is  reported,  and  understand  any  sig- 
nificant limitations. 


Objectives 


12.    The  statement  of  objectives  being  reported  on 
should  explain  why  the  audit  was  made  and  state 
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what  the  report  is  to  accomplish.  Articulating  what 
the  report  is  to  accomplish  normally  involves  identi- 
fying the  audit  subject  and  the  aspect  of  perfor- 
mance examined,  and  because  what  is  reported 
depends  on  the  objectives,  communicating  what 
finding  elements  are  discussed  and  whether  conclu- 
sions and  recommendations  are  being  given. 

13.    The  statement  of  objectives  tells  the  reader  the 
boundaries  of  the  audit.  To  preclude  misunder- 
standing in  cases  where  the  pursued  objectives  are 
particularly  limited  and  broader  objectives  can  be 
inferred,  it  may  be  necessary  to  clearly  define  the 
audit  boundaries  by  stating  objectives  that  were  not 
pursued. 


Scope  and  14.    The  statement  of  scope  should  describe  the  depth 

Methodology  and  coverage  of  audit  work  conducted  to  accom- 

plish the  audit's  objectives.  It  should,  as  applicable, 
explain  the  relationship  between  the  universe  and 
what  was  audited,  identify  organizations  and  geo- 
graphic locations  at  which  audit  work  was  con- 
ducted and  the  time  period  covered,  cite  the  kinds 
and  sources  of  evidence  used  and  the  techniques 
used  to  verify  it,  and  explain  any  quality  or  other 
problems  with  the  evidence.  If  unverified  data  are 
used,  this  needs  to  be  stated.  Any  constraints 
imposed  on  the  audit  approach  by  data  limitations 
or  scope  impairments  (see  chapter  3,  paragraph  42) 
are  to  be  disclosed. 

15.    The  statement  on  methodology  should  clearly 
explain  the  evidence  gathering  and  analysis  tech- 
niques used  to  accomplish  the  audit's  objectives. 
The  explanation  should  identify  any  assumptions 
made  in  conducting  the  audit,  describe  any  compar- 
ative techniques  applied  and  measures  and  criteria 
used  to  assess  performance,  and  if  sampling  is 
involved,  describe  the  sample  design  and  state  why 
it  was  chosen. 
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16.   Every  effort  should  be  made  to  avoid  any  misun- 
derstanding by  the  reader  concerning  the  work  that 
was  and  was  not  done  to  achieve  the  audit  objec- 
tives, particularly  when  the  work  was  limited  by 
relying  on  internal  controls  or  because  of  con- 
straints on  time  or  resources. 


Audit  Findings 
and  Conclusions 


17.    The  report  should  include  a  full  discussion  of 
the  audit  findings,  and  where  applicable,  the 
auditor's  conclusions. 


Findings 


18.    The  report  should  present  che  findings  and  finding 
elements  developed  in  response  to  the  audit  objec- 
tive.1 Sufficient,  competent  and  relevant  informa- 
tion about  findings  should  be  included  to  promote 
adequate  understanding  of  the  matters  reported 
and  to  provide  convincing,  but  fair  presentations  in 
proper  perspective.  Appropriate  background  infor- 
mation that  readers  need  to  understand  the  findings 
should  also  be  included. 


19.    Audit  findings  have  often  been  regarded  as  contain- 
ing the  elements  of  criteria,  condition,  and  effect, 
plus  cause  when  problems  are  found.  However,  the 
elements  needed  for  a  complete  finding  depend 
entirely  on  the  objectives  of  the  audit.  Thus,  a  find- 
ing or  set  of  findings  is  complete  to  the  extent  that 
the  audit  objectives  are  satisfied  and  the  report 
clearly  relates  those  objectives  to  the  finding's 
elements. 


Conclusions 


20.    The  report  should  contain  conclusions  when  called 
for  by  the  audit  objectives.  Conclusions  should  be 


'Any  audit  findings  not  included  in  the  audit  report,  e.g.,  because 
of  insignificance,  should  be  separately  communicated  to  manage- 
ment, preferably  in  writing.  The  audit  report  should  reference 
findings  communicated  in  a  management  letter  to  top  manage- 
ment. All  communications  should  be  documented  in  the  working 
papers. 


Page  7-4 


Chapter  7 

Reporting  Standards  for 

Performance  Audits 


specified  and  not  left  to  be  inferred  by  readers.  The 
report  should  not  be  written  on  the  basis  that  a  bare 
recital  of  facts  makes  the  conclusions  inescapable. 


Cause  and 
Recommendations 


21.    The  report  should  include  the  cause  of  problem 
areas  noted  in  the  audit,  and  recommendations 
for  actions  to  correct  the  problem  areas  and  to 
improve  operations,  when  called  for  by  the  audit 
objectives. 


Cause 


22.  The  report  should  include  a  discussion  of  cause 
when  problems  are  reported  and  the  audit  objec- 
tives call  for  development  of  the  reasons  for  the 
problems.  In  some  audits,  the  objective  may  be  lim- 
ited to  identifying  whether  or  not  a  problem  exists 
with  no  requirement  for  identifying  the  cause,  even 
if  a  problem  is  found. 

23.  Identifying  the  underlying  cause  of  problems  found 
is  helpful  in  making  constructive  recommendations 
to  achieve  corrective  action.  When  auditors  know 
why  something  happened,  they  can  more  readily 
determine  what  action  is  needed  to  prevent  its 
recurrence. 

24.  Because  problems  can  result  from  a  number  of  plau- 
sible factors,  auditors  need  to  clearly  demonstrate 
and  explain  with  applicable  evidence  and  reasoning 
the  link  between  the  problem  and  the  factor  or  fac- 
tors they  identified  as  the  cause.  In  some  cases,  the 
auditors  may  need  to  describe  how  they  isolated  the 
stated  cause  or  causes  from  other  plausible  factors. 
This  is  not  a  requirement  for  proof  of  a  causal  rela- 
tionship, but  a  requirement  for  reasonable  persua- 
sive argument. 


Recommendations 


25.    The  report  should  contain  recommendations  when 
the  potential  for  significant  improvement  in  opera 
tions  and  performance  is  substantiated  by  the 
reported  findings  and  recommendations  are  called 
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for  by  the  audit  objectives.  Recommendations  to 
effect  compliance  with  laws  and  regulations  and 
improve  internal  controls  should  also  be  made  when 
significant  instances  of  noncompliance  are  noted  or 
significant  weaknesses  in  controls  are  found.  The 
auditor's  report  should  also  disclose  the  status  of 
known  uncorrected  significant  findings  and  recom- 
mendations from  prior  audits  that  affect  the  objec- 
tives and  findings  of  the  current  audit. 

26.    Reports  which  contain  constructive  recommenda- 
tions can  encourage  improvements  in  the  conduct  of 
government  programs  and  activities.  Recommenda- 
tions are  most  constructive  when  they  are  directed 
at  resolving  the  cause  of  identified  problems,  are 
action  oriented  and  specific,  and  are  addressed  to 
parties  that  need  to  act.  Recommendations  also 
need  to  be  feasible  and  cost-effective. 


Statement  on 

Auditing 

Standards 


27.    The  report  should  include  a  statement  that  the 
audit  was  made  in  accordance  with  generally 
accepted  government  auditing  standards  and 
disclose  when  applicable  standards  were  not 
followed. 


28.    The  statement  of  conformity  refers  to  the  applica- 
ble standards  that  the  auditors  should  have  fol- 
lowed during  the  audit.  The  statement  need  not  be 
qualified  when  standards  that  were  not  applicable 
were  not  followed.  When  applicable  standards  were 
not  followed,  the  auditors  should  modify  the  state- 
ment to  disclose  in  the  scope  section  of  their  report 
the  required  standard  that  was  not  followed,  the 
reasons  therefor,  and  the  known  effect  not  follow- 
ing the  standard  had  on  the  results  of  the  audit. 


Internal 
Controls 


29.    The  report  should  identify  the  significant  inter- 
nal controls  that  were  assessed,  the  scope  of  the 
auditor's  assessment  work,  and  any  significant 
weaknesses  found  during  the  audit. 
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30.  Reporting  on  internal  controls  will  vary  depending 
on  the  significance  of  any  weaknesses  found  and 
the  relationship  of  those  weaknesses  to  the  audit 
objectives.2 

31.  In  audits  where  the  sole  objective  is  to  audit  the 
internal  controls,  weaknesses  found  of  significance 
to  warrant  reporting  would  be  considered  deficien- 
cies and  be  so  identified  in  the  audit  report.  The 
internal  controls  that  were  assessed  would  be  iden- 
tified for  full  presentation  of  the  findings. 

32.  In  audits  having  as  their  objective  an  assessment  of 
performance,  auditors  in  seeking  the  cause  of  defi- 
cient performance  found,  may  identify  weaknesses 
in  internal  controls  of  such  significance  to  be  a  key 
source  of  the  deficient  performance.  In  reporting 
findings,  the  controls  would  be  identified  and  the 
weaknesses  would  be  described  as  the  "cause." 


Compliance 
With  Laws  and 
Regulations 


33.     The  report  should  include  all  significant 

instances  of  noncompliance  and  abuse  and  all 
indications  or  instances  of  illegal  acts  that  could 
result  in  criminal  prosecution  that  were  found 
during  or  in  connection  with  the  audit.3 


Noncompliance 


34.    The  auditors'  report  should  include  all  significant 
instances  of  noncompliance  found  during  or  in  con- 
nection with  the  audit,  even  those  not  resulting  in  a 
legal  liability  of  the  entity.  All  instances  of  illegal 
acts  that  could  result  in  the  entity,  or  an  official  or 
employee  of  the  entity,  being  subject  to  criminal 
prosecution  should  also  be  reported.  (See  paragraph 
42,  page  7-9). 


2See  footnote  1 ,  page  7-4,  for  reporting  internal  control  weak- 
nesses not  meeting  the  test  of  significance. 

^See  footnote  1 ,  page  7-4  for  reporting  on  instances  of  noncompli- 
ance not  meeting  the  test  of  significance. 
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35.    In  reporting  significant  instances  of  noncompliance 
identified  in  response  to  the  audit  objectives,  the 
auditors  should  place  their  findings  in  proper  per- 
spective. To  give  the  reader  a  basis  forjudging  the 
prevalence  and  consequences  of  noncompliance,  the 
instances  of  noncompliance  should  be  related  to  the 
universe  or  the  number  of  cases  examined  and  be 
quantified  in  terms  of  dollar  value,  if  appropriate. 


Abuse  and  Illegal  36.    If,  during  an  audit  or  in  connection  with  an  audit  of 

Acts  a  government  entity,  external  government  auditors 

become  aware  of  abuse  or  illegal  acts  or  indications 
of  such  acts  that  could  affect  the  government 
entity,  they  should  promptly  report  to  the  top  offi- 
cial of  that  entity.  The  auditor  should  also  consider 
reporting  to  the  appropriate  oversight  body.  If  the 
top  official  is  believed  to  be  a  party  to  such  acts  or 
otherwise  implicated,  the  auditor  should  in  all  cases 
report  to  the  appropriate  oversight  body.  If  the  acts 
involve  funds  received  from  other  government  enti- 
ties, the  auditors  should  also  promptly  report  to  the 
proper  officials,  including  the  audit  officials,  of 
those  entities. 

37.  Internal  government  auditors  auditing  an  entity 
that  is  external  to  the  entity  to  which  they  are 
assigned  should  promptly  report  to  officials  and 
authorities  in  accordance  with  the  preceding 
paragraph. 

38.  Internal  government  auditors  auditing  within  the 
government  entity  to  which  they  are  assigned, 
should  report  to  the  top  officials  of  the  entity  under 
audit  (unless  the  official  is  believed  to  be  a  party  to 
such  acts)  and/or  the  appropriate  entity  investiga- 
tive personnel. 


39.    Nongovernment  audit  organizations  conducting 
government  audits  will  discharge  their  responsibili- 
ties for  reporting  abuse  or  illegal  acts  or  indications 
of  such  acts  found  during  or  in  connection  with  an 
audit  by  promptly  reporting  to  the  top  official  of 
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the  entity  arranging  for  the  audit.  The  auditor 
should  also  consider  reporting  to  the  appropriate 
oversight  body.  If  the  audited  entity  and  the  top 
official  is  believed  to  be  a  party  to  such  acts  or 
otherwise  implicated,  the  auditors  should  in  all 
cases  report  to  the  appropriate  oversight  body. 
Also,  when  the  acts  involve  funds  received  from 
other  government  entities,  the  audited  entity  is 
expected  to  notify  the  proper  officials,  including  the 
audit  officials,  of  those  entities.  If  the  entity  does 
not  do  so  within  a  reasonable  time  or  was  unable  to 
because  the  top  official  was  involved,  the  auditor 
should  report  to  the  officials  of  those  other  govern- 
ment entities. 

40.  It  is  the  responsibility  of  an  entity  receiving  the 
information  from  the  various  organizations,  both 
audited  entity  and  funding  entity,  to  report  to 
appropriate  law  enforcement  authorities  and  other 
government  entities  whose  funds  are  involved. 

41.  In  the  case  of  an  audit  of  government  funds 
received  by  a  nongovernment  entity,  the  auditors 
should  promptly  report  to  the  appropriate  govern- 
ment entity  requiring  or  arranging  for  the  audit, 
and  such  other  officials  designated  by  law  or  regu- 
lation to  receive  the  audit  reports. 

42.  Abuse  or  illegal  acts  or  indications  of  such  acts  that 
auditors  become  aware  of  should  be  covered  in  a 
written  report  and  submitted  in  accordance  with 
the  preceding  paragraphs.  Such  acts  may  be  cov- 
ered in  a  separate  report  if  including  them  in  the 
overall  report  would  compromise  investigative  or 
legal  proceedings  or  otherwise  preclude  the  report 
from  being  released  to  the  public.  Auditors  gener- 
ally should  not  release  information  or  reports  con- 
taining information  on  potential  illegal  acts  that 
could  result  in  the  entity,  or  officer  or  employee  of 
the  entity,  being  subjected  to  criminal  prosecution, 
or  reports  with  references  that  such  acts  were  omit- 
ted from  reports,  without  consulting  with  appropri- 
ate legal  counsel,  since  this  could  interfere  with 
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legal  processes  or  subject  the  implicated  individuals 
to  undue  publicity,  or  might  subject  the  auditor  to 
potential  legal  action. 


Views  of 

Responsible 

Officials 


43.  The  report  should  include  the  pertinent  views  of 
responsible  officials  of  the  organization,  pro- 
gram, activity,  or  function  audited  concerning 
the  auditors*  findings,  conclusions,  and  recom- 
mendations, and  what  corrective  action  is 
planned. 

44.  One  of  the  most  effective  ways  to  ensure  that  a 
report  is  fair,  complete,  and  objective  is  to  obtain 
advance  review  and  comments  by  responsible 
auditee  officials,  and  others  as  may  be  appropriate. 
Including  the  views  of  responsible  officials  pro- 
duces a  report  that  shows  not  only  what  was  found 
and  what  the  auditors  think  about  it,  but  also  what 
the  responsible  persons  think  about  it  and  what 
they  plan  to  do  about  it. 

45.  The  auditor  should  normally  request  that  the 
responsible  officials'  views  be  submitted  in  writing 
for  significant  findings,  conclusions,  and  recommen- 
dations adversely  affecting  the  audited  entity. 
When,  in  these  cases,  written  comments  are  not 
obtained,  oral  comments  should  be  requested. 

46.  Advance  comments  should  be  objectively  evaluated 
and  recognized,  as  appropriate,  in  the  report.  A 
promise  or  plan  for  corrective  action  should  be 
noted  but  should  not  be  accepted  as  justification  for 
dropping  a  significant  point  or  a  related 
recommendation. 


47.    When  the  comments  oppose  the  report's  findings, 
conclusions,  or  recommendations,  and  are  not  in  the 
auditors'  opinion  valid,  the  auditors  may  choose  to 
state  their  reasons  for  rejecting  them.  Conversely, 
the  auditors  should  modify  their  report  if  they  find 
the  comments  valid. 
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Noteworthy 
Accomplishments 


48.  The  report  should  include  a  description  of  any 
significant  noteworthy  accomplishments,  partic- 
ularly when  management  improvements  in  one 
area  may  be  applicable  elsewhere. 

49.  Significant  management  accomplishments  identified 
during  the  audit,  which  were  within  the  scope  of 
the  audit  necessary  to  accomplish  the  audit  objec- 
tives, should  be  included  in  the  audit  report,  along 
with  deficiencies.  Such  information  is  necessary  to 
fairly  present  the  situation  the  auditors  find  and  to 
provide  appropriate  balance  to  the  report.  In  addi- 
tion, inclusion  of  such  accomplishments  may  lead  to 
improved  performance  by  other  government  organi- 
zations that  read  the  report. 


Issues  Needing 
Further  Study 


50.    The  report  should  include  a  listing  of  any  signifi- 
cant issues  needing  further  study  and 
consideration. 


51.    If  during  the  audit,  the  auditor  identifies  significant 
issues  that  warrant  further  audit  work,  but  the 
issues  are  not  directly  related  to  the  audit  objectives 
and  the  auditor  does  not  expand  the  audit  and  pur- 
sue them,  the  auditor  should: 

a.  refer  the  issues  to  the  appropriate  auditors 
within  the  audit  organization  responsible  for  plan- 
ning future  audit  work,  and 

b.  disclose  the  issues  in  the  report  and  the  reasons 
the  issues  need  further  study. 


Privileged  and 

Confidential 

Information 


52.    The  report  should  include  a  statement  about  any 
pertinent  information  that  was  omitted  because 
it  is  deemed  privileged  or  confidential.  The 
nature  of  such  information  should  be  described, 
and  the  basis  under  which  it  is  withheld  should 
be  stated. 
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53.    Certain  information  may  be  prohibited  from  general 
disclosure  by  federal,  state,  or  local  laws  or  regula- 
tions. Such  information  may  be  provided  on  a  need- 
to-know  basis  only  to  persons  authorized  by  law  or 
regulation  to  receive  it.  Before  omitting  pertinent 
data  from  the  report,  the  auditors  should  obtain 
assurance  that  a  valid  requirement  for  the  omission 
exists,  and  where  appropriate,  consult  with  legal 
counsel. 


54.    Auditors  should  generally  consult  with  appropriate 
legal  counsel  before  releasing  reports  with  refer- 
ences that  illegal  acts  or  indications  of  such  acts 
were  omitted  from  reports.4 


Report 
Presentation 


55.    The  fourth  reporting  standard  for  government  per- 
formance audits  is: 

The  report  should  be  complete,  accurate,  objec- 
tive, and  convincing,  and  be  as  clear  and  concise 
as  the  subject  matter  permits. 


Complete 


56.    Being  complete  requires  that  the  report  contain  all 
pertinent  information  needed  to  satisfy  the  audit 
objectives,  promote  an  adequate  and  correct  under- 
standing of  the  matters  reported,  and  meet  the 
applicable  report  content  requirements.  It  also 
means  including  appropriate  background 
information. 


57. 


58 


Giving  readers  an  adequate  and  correct  understand- 
ing means  providing  perspective  on  the  extent  and 
significance  of  reported  findings,  such  as  the  fre- 
quency of  occurrence  relative  to  the  number  of 
cases  or  transactions  tested  and  the  relationship  of 
the  findings  to  the  entity's  operations. 

Kxcept  as  necessary  to  make  convincing  presenta- 
tions, detailed  supporting  data  need  not  be  included 


4See  paragraph  42  on  page  7-9. 
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In  most  cases,  a  single  example  of  a  deficiency  is  not 
sufficient  to  support  a  broad  conclusion  or  a  related 
recommendation.  All  that  it  supports  is  that  there 
was  a  deviation,  an  error,  or  a  weakness. 


Accurate 


59.  Accuracy  requires  that  the  evidence  presented  be 
true  and  that  findings  be  correctly  portrayed.  The 
need  for  accuracy  is  based  on  the  need  to  assure 
readers  that  what  is  reported  is  credible  and  reli- 
able. One  inaccuracy  in  a  report  can  cast  doubt  on 
the  validity  of  an  entire  report  and  can  divert  atten- 
tion from  the  substance  of  the  report.  Also,  inaccu- 
rate reports  can  damage  the  credibility  of  the 
issuing  audit  organization  and  reduce  the  effective- 
ness of  reports  it  issues. 

60.  The  report  should  include  only  information,  find- 
ings, and  conclusions  that  are  supported  by  compe- 
tent and  relevant  evidence  in  the  auditor's  working 
papers.  That  evidence  should  demonstrate  the  cor- 
rectness and  reasonableness  of  the  matters 
reported.  Correct  portrayal  means  describing  accu- 
rately the  audit  scope  and  methodology,  and 
presenting  findings  and  conclusions  in  a  manner 
consistent  with  the  scope  of  audit  work. 


Objective 


61.  Objectivity  requires  that  the  presentation  through- 
out the  report  be  balanced  in  content  and  tone.  A 
report's  credibility  is  significantly  enhanced  when  it 
presents  evidence  in  an  unbiased  manner  so  that 
readers  are  persuaded  by  the  facts. 

62.  The  audit  report  should  be  fair  and  not  be  mislead- 
ing, and  should  place  the  audit  results  in  proper 
perspective.  This  means  presenting  the  audit  results 
impartially  and  guarding  against  the  tendency  to 
exaggerate  or  overemphasize  deficient  perfor- 
mance. In  describing  shortcomings  in  performance, 
auditors  should  present  the  explanation  of  responsi- 
ble officials  including  the  consideration  of  any 
unusual  difficulties  or  circumstances  they  faced. 
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63.    The  tone  of  reports  should  encourage  favorable 
reaction  to  findings  and  recommendations.  Titles, 
captions,  and  the  text  of  reports  should  be  stated 
constructively.  Although  findings  should  be  pre- 
sented in  clear,  forthright  terms,  the  auditors 
should  keep  in  mind  that  one  of  their  objectives  is  to 
be  persuasive,  and  that  this  can  best  be  done  by 
avoiding  language  that  unnecessarily  generates 
defensiveness  and  opposition.  Although  criticism  of 
past  performance  is  often  necessary,  the  report 
should  emphasize  needed  improvements. 


Convincing  64.    Being  convincing  requires  that  the  audit  results  be 

responsive  to  the  audit  objectives,  and  that  the  find- 
ings be  presented  in  a  manner  that  is  persuasive 
and  that  conclusions  and  recommendations  follow 
logically  from  the  facts  presented.  The  information 
presented  should  be  sufficient  to  persuade  the  read- 
ers of  the  validity  of  the  findings,  the  reasonable- 
ness of  the  conclusions,  and  the  desirability  of  their 
accepting  the  recommendations.  Reports  designed  in 
this  manner  can  do  much  to  focus  the  attention  of 
responsible  officials  on  the  matters  in  reports  that 
warrant  attention  and  to  stimulate  corrective 
actions. 


Clear  65.    Clarity  requires  that  the  report  be  easy  to  read  and 

understand.  Reports  should  be  written  in  language 
as  clear  and  simple  as  the  subject  matter  permits. 

66.    Use  of  straightforward,  nontechnical  language  is 
essential  to  simplicity  of  presentation.  If  technical 
terms  and  unfamiliar  abbreviations  and  acronyms 
are  used,  they  should  be  clearly  defined.  Acronyms 
should  be  used  sparingly. 


67.    Both  logical  organization  of  material,  and  accuracy 
and  precision  in  stating  facts  and  in  drawing  conclu- 
sions, are  essential  to  clarity  and  understanding. 
Effective  use  of  titles  and  captions  and  thesis  and 
topic  sentences  make  the  report  easier  to  read  and 
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understand.  Visual  aids  (such  as  pictures,  charts, 
graphs,  and  maps)  should  be  used  when  appropri- 
ate to  clarify  and  summarize  complex  material. 


Concise 


68.  Being  concise  requires  that  the  report  be  no  longer 
than  necessary  to  convey  the  message.  Too  much 
detail  detracts  from  a  report,  may  even  conceal  the 
real  message,  and  may  confuse  or  discourage  read- 
ers. Needless  repetition  should  be  avoided. 

69.  Although  room  exists  for  considerable  judgment  in 
determining  the  content  of  reports,  those  that  are 
complete,  but  still  concise,  are  likely  to  receive 
greater  attention. 


Report 
Distribution 


70.  The  fifth  reporting  standard  for  government  per- 
formance audits  is: 

Written  audit  reports  are  to  be  submitted  by  the 
audit  organization  to  the  appropriate  officials  of 
the  organization  audited,  and  to  the  appropriate 
officials  of  the  organizations  requiring  or 
arranging  for  the  audits,  including  external 
funding  organizations,  unless  legal  restrictions, 
ethical  considerations,  or  other  arrangements 
prevent  it.  Copies  of  the  reports  should  also  be 
sent  to  other  officials  who  may  be  responsible 
for  taking  action  on  audit  findings  and  recom- 
mendations and  to  others  authorized  to  receive 
such  reports.  Unless  restricted  by  law  or  regula- 
tion, copies  should  be  made  available  for  public 
inspection. 

71.  Audit  reports  should  be  distributed  to  as  many 
interested  officials  as  is  practicable.  In  some  cases, 
the  subject  of  the  audit  may  involve  material  that  is 
classified  for  security  purposes  or  is  not  releasable 
to  particular  parties  or  the  public  for  other  valid 
reasons.  Generally,  however,  the  report  should  be 
distributed  to  officials  directly  interested  in  the 
results.  Such  officials  include  those  designated  by 
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law  or  regulation  to  receive  such  reports,  those 
responsible  for  acting  on  the  findings  and  recom- 
mendations, legislators,  and  those  of  other  levels  of 
government  that  have  provided  funds  to  the 
audited  entity. 

72.  Internal  auditors  auditing  within  their  entity  should 
follow  their  entity's  own  arrangements  and  statu- 
tory requirements.  Usually,  they  report  to  their 
entity's  top  management  and  the  entity  is  responsi- 
ble for  distribution  of  the  report. 

73.  When  nongovernment  audit  organizations  are 
engaged,  the  engaging  government  organization  is 
responsible  for  distributing  the  reports  and  for 
making  reports  available  to  the  public,  as  appropri- 
ate. If  the  nongovernment  audit  organization  is  to 
make  the  distribution,  the  engagement  agreement 
should  indicate  what  officials  or  organizations 
should  receive  the  report. 
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I.  Introduction 

A.  Purpose 

1.  This  statement  contains  standards  for  audits  of  government  organizations,  programs, 
activities,  and  functions,  and  of  government  funds  received  by  contractors,  nonprofit 
organizations,  and  other  nongovernment  organizations. 

2.  The  standards  are  to  be  followed  by  auditors  and  audit  organizations  when  required  by 
law,  regulation,  agreement  or  contract,  or  policy. 

II.  Types  of  Government  Audits 

A.  Purpose 

1 .  This  chapter  describes  the  types  of  audits  that  government  and  nongovernment  audit 
organizations  conduct,  and  that  government  organizations  arrange  to  have  conducted. 
This  description  is  not  intended  to  limit  or  require  the  types  of  audits  that  may  be 
conducted  or  arranged. 

2.  In  conducting  these  types  of  audits,  auditors  should  follow  the  applicable  standards 
included  and  incorporated  in  this  statement. 

B.  Financial  Audits 

1 .  Financial  statement  audits  determine  (a)  whether  the  financial  statements  of  an  audited 
entity  present  fairly  the  financial  position,  results  of  operations,  and  cash  flows  or  changes 
in  financial  position  in  accordance  with  generally  accepted  accounting  principles,  and 

(b)  whether  the  entity  has  complied  with  laws  and  regulations  for  those  transactions  and 
events  that  may  have  a  material  effect  on  the  financial  statements. 

2.  Financial  related  audits  include  determining  (a)  whether  financial  reports  and  related 
items,  such  as  elements,  accounts,  or  funds  are.  fairly  presented,  (b)  whether  financial 
information  is  presented  in  accordance  with  established  or  stated  criteria,  and  (c)  whether 
the  entity  has  adhered  to  specific  financial  compliance  requirements. 

C.  Performance  Audits 

1.  Economy  and  efficiency  audits  include  determining  (a)  whether  the  entity  is  acquiring, 
protecting,  and  using  its  resources  (such  as  personnel,  property,  and  space)  economically 
and  efficiently,  (b)  the  causes  of  inefficiencies  or  uneconomical  practices,  and  (c)  whether 
the  entity  has  complied  with  laws  and  regulations  concerning  matters  of  economy  and 
efficiency. 

2.  Program  audits  include  determining  (a)  the  extent  to  which  the  desired  results  or 
benefits  established  by  the  legislature  or  other  authorizing  body  are  being  achieved, 
(b)  the  effectiveness  of  organizations,  programs,  activities,  or  functions,  and  (c)  whether 
the  entity  has  complied  with  laws  and  regulations  applicable  to  the  program. 

(continued) 
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D.  Understanding  the  Audit  Objectives  and  Scope 

1 .  Audits  may  have  a  combination  of  financial  and  performance  audit  objectives,  or  may 
have  objectives  limited  to  only  some  aspects  of  one  audit  type. 

2.  Auditors  should  follow  the  appropriate  standards  in  this  statement  that  are  applicable 
to  the  individual  objectives  of  the  audit. 

E.  Other  Activities  of  An  Audit  Organization 

1 .  Services  other  than  audits:  The  head  of  the  audit  organization  should  establish  policy 
on  which  audit  standards  from  this  statement  should  be  followed  by  the  auditors  in 
performing  such  services.  However,  as  a  minimum,  auditors  should  collectively  possess 
adequate  professional  proficiency  and  exercise  due  professional  care  for  the  service 
being  performed. 

2.  Investigative  work:  The  head  of  the  audit  organization  should  establish  policy  on 
whether  the  audit  standards  in  this  statement,  or  some  other  appropriate  standards,  are 
to  be  followed  by  the  employees  performing  this  work. 

3.  Nonaudit  activities:  The  head  of  the  audit  organization  should  establish  policy  on  what 
standards  in  this  statement  are  to  be  followed,  or  whether  some  other  appropriate 
standards  are  to  be  followed,  by  the  employees  in  performing  this  type  of  work. 

III.  General  Standards 

A.  Qualifications:  The  staff  assigned  to  conduct  the  audit  should  collectively  possess 
adequate  professional  proficiency  for  the  tasks  required. 

B.  Independence:  In  all  matters  relating  to  the  audit  work,  the  audit  organization  and  the 
individual  auditors,  whether  government  or  public,  should  be  free  from  personal  and  external 
impairments  to  independence,  should  be  organizationally  independent,  and  should  maintain 
an  independent  attitude  and  appearance. 

C.  Due  Professional  Care:  Due  professional  care  should  be  used  in  conducting  the  audit  and 
in  preparing  related  reports. 

D.  Quality  Control:  Audit  organizations  conducting  government  audits  should  have  an 
appropriate  internal  quality  control  system  in  place  and  participate  in  an  external  quality 
control  review  program. 

IV.  Field  Work  Standards  for  Financial  Audits 
A.  Relationship  to  AICPA  Standards 

1 .  The  standards  of  field  work  for  government  financial  audits  incorporate  the  AICPA 
standards  of  field  work  for  financial  audits,  and  prescribes  supplemental  standards  of  field 
work  needed  to  satisfy  the  unique  needs  of  government  financial  audits. 

2.  The  field  work  standards  of  the  AICRA  and  the  supplemental  standards  in  chapter  4  of 
this  statement  apply  to  both  financial  statement  audits  and  financial  related  audits. 

(continued) 
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B.  Planning: 

1 .  Supplemental  planning  field  work  standards  for  government  financial  audits  are: 

a.  Audit  Requirements  for  all  Government  Levels:  Planning  should  include  consideration 
of  the  audit  requirements  of  all  levels  of  government. 

b.  Legal  and  Regulatory  Requirements:  A  test  should  be  made  of  compliance  with 
applicable  laws  and  regulations. 

(1)  In  determining  compliance  with  laws  and  regulations: 

(a)  The  auditor  should  design  audit  steps  and  procedures  to  provide  reasonable 
assurance  of  detecting  errors,  irregularities,  and  illegal  acts  that  could  have  a  direct 
and  material  effect  on  the  financial  statement  amounts  or  the  results  of  financial 
related  audits. 

(b)  The  auditor  should  also  be  aware  of  the  possibility  of  illegal  acts  which  could 
have  an  indirect  and  material  effect  on  the  financial  statements  or  results  of 
financial  related  audits. 

C.  Evidence  (Working  papers) 

1 .  The  AICPA  field  work  standards  and  this  statement  require  that:  A  record  of  the 
auditors'  work  be  retained  in  the  form  of  working  papers. 

2.  Supplemental  working  paper  requirements  for  financial  audits  are  that  working  papers 
should: 

a.  Contain  a  written  audit  program  cross-referenced  to  the  working  papers. 

b.  Contain  the  objective,  scope,  methodology  and  results  of  the  audit. 

c.  Contain  sufficient  information  so  that  supplementary  oral  explanations  are  not 
required. 

d.  Be  legible  with  adequate  indexing  and  cross-referencing,  and  include  summaries  and 
lead  schedules,  as  appropriate. 

e.  Restrict  information  included  to  matters  that  are  materially  important  and  relevant  to 
the  objectives  of  the  audit. 

f.  Contain  evidence  of  supervisory  reviews  of  the  work  conducted. 

D.  Internal  Control 

1 .  The  AICPA  field  work  standards  and  this  statement  require  that:  A  sufficient 
understanding  of  the  internal  control  structure  is  to  be  obtained  to  plan  the  audit  and  to 
determine  the  nature,  timing,  and  extent  of  tests  to  be  performed. 

(continued) 
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V.  Reporting  Standards  for  Financial  Audits 

A.  Relationship  to  AICPA  Standards 

1 .  The  standards  of  reporting  for  government  financial  audits  incorporate  the  AICPA 
standards  of  reporting  for  financial  audits,  and  prescribes  supplemental  standards  of 
reporting  needed  to  satisfy  the  unique  needs  of  government  financial  audits. 

2.  The  reporting  standards  of  the  AICPA  and  the  supplemental  standards  in  chapter  5  of 
this  statement  apply  to  both  financial  statement  audits  and  financial  related  audits. 

B.  Supplemental  reporting  standards  for  government  financial  audits  are: 

1.  Statement  on  Auditing  Standards:  A  statement  should  be  included  in  the  auditors' 
report  that  the  audit  was  made  in  accordance  with  generally  accepted  government 
auditing  standards.  (AICPA  standards  require  that  public  accountants  state  that  the  audit 
was  made  in  accordance  with  generally  accepted  auditing  standards.  In  conducting 
government  audits,  public  accountants  should  also  state  that  their  audit  was  conducted  in 
accordance  with  the  standards  set  forth  in  chapters  3,  4,  and  5.) 

2.  Report  on  Compliance:  The  auditors  should  prepare  a  written  report  on  their  tests  of 
compliance  with  applicable  laws  and  regulations.  This  report,  which  may  be  included  in 
either  the  report  on  the  financial  audit  or  a  separate  report,  should  contain  a  statement  of 
positive  assurance  on  those  items  which  were  tested  for  compliance  and  negative 
assurance  on  those  items  not  tested.  It  should  include  all  material  instances  of 
noncompliance,  and  all  instances  or  indications  of  illegal  acts  which  could  result  in 
criminal  prosecution. 

3.  Report  on  Internal  Controls:  The  auditors  should  prepare  a  written  report  on  their 
understanding  of  the  entity's  internal  control  structure  and  the  assessment  of  control  risk 
made  as  part  of  a  financial  statement  audit,  or  a  financial  related  audit.  This  report  may  be 
included  in  either  the  auditor's  report  on  the  financial  audit  or  a  separate  report.  The 
auditor's  report  should  include  as  a  minimum:  (a)  the  scope  of  the  auditor's  work  in 
obtaining  an  understanding  of  the  internal  control  structure  and  in  assessing  the  control 
risk,  (b)  the  entity's  significant  internal  controls  or  control  structure  including  the  controls 
established  to  ensure  compliance  with  laws  and  regulations  that  have  a  material  impact 
on  the  financial  statements  and  the  results  of  the  financial  related  audit,  and  (c)  the 
reportable  conditions,  including  the  identification  of  material  weaknesses,  identified  as  a 
result  of  the  auditors  work  in  understanding  and  assessing  the  control  risk. 

4.  Reporting  on  Financial  Related  Audits:  Written  audit  reports  are  to  be  prepared  giving 
the  results  of  each  financial  related  audit. 

5.  Privileged  and  Confidential  Information:  If  certain  information  is  prohibited  from  general 
disclosure,  the  report  should  state  the  nature  of  the  information  omitted  and  the 
requirement  that  makes  the  omission  necessary. 

(continued) 
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6.  Report  Distribution:  Written  audit  reports  are  to  be  submitted  by  the  audit  organization 
to  the  appropriate  officials  of  the  organization  audited  and  to  the  appropriate  officials  of 
the  organizations  requiring  or  arranging  for  the  audits,  including  external  funding 
organizations,  unless  legal  restrictions,  ethical  considerations,  or  other  arrangements 
prevent  it.  Copies  of  the  reports  should  also  be  sent  to  other  officials  who  have  legal 
oversight  authority  or  who  may  be  responsible  for  taking  action  and  to  others  authorized 
to  receive  such  reports.  Unless  restricted  by  law  or  regulation,  copies  should  be  made 
available  for  public  inspection. 

VI.  Field  Work  Standards  for  Performance  Audits 

A.  Planning:  Work  is  to  be  adequately  planned. 

B.  Supervision:  Staff  are  to  be  properly  supervised. 

C.  Legal  and  Regulatory  Requirements:  An  assessment  is  to  be  made  of  compliance  with 
applicable  requirements  of  laws  and  regulations  when  necessary  to  satisfy  the  audit 
objectives. 

1.  Where  an  assessment  of  compliance  with  laws  and  regulations  is  required:  Auditors 
should  design  the  audit  to  provide  reasonable  assurance  of  detecting  abuse  or  illegal  acts 
that  could  significantly  affect  the  audit  objectives. 

2.  In  all  performance  audits:  Auditors  should  be  alert  to  situations  or  transactions  that 
could  be  indicative  of  abuse  or  illegal  acts. 

D.  Internal  Control:  An  assessment  should  be  made  of  applicable  internal  controls  when 
necessary  to  satisfy  the  audit  objectives. 

E.  Evidence:  Sufficient,  competent,  and  relevant  evidence  is  to  be  obtained  to  afford  a 
reasonable  basis  for  the  auditors'  judgments  and  conclusions  regarding  the  organization, 
program,  activity,  or  function  under  audit.  A  record  of  the  auditors'  work  is  to  be  retained  in 
the  form  of  working  papers.  Working  papers  may  include  tapes,  films,  and  discs. 

VII.  Reporting  Standards  for  Performance  Audits 

A.  Form:  Written  audit  reports  are  to  be  prepared  communicating  the  results  of  each 
government  audit. 

B.  Timeliness:  Reports  are  to  be  issued  promptly  so  as  to  make  the  information  available  for 
timely  use  by  management  and  legislative  officials,  and  by  other  interested  parties. 

C.  Report  Contents 

1 .  Objectives,  Scope,  and  Methodology:  The  report  should  include  a  statement  of  the 
audit  objectives  and  a  description  of  the  audit  scope  and  methodology. 

2.  Audit  Findings  and  Conclusions:  The  report  should  include  a  full  discussion  of  the  audit 
findings,  and  where  applicable,  the  auditor's  conclusions. 

(continued) 
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3  Cause  and  Recommendations:  The  report  should  include  the  cause  of  problem  areas 
noted  in  the  audit,  and  recommendations  for  actions  to  correct  the  problem  areas  and  to 
improve  operations,  when  called  for  by  the  audit  objectives. 

4  Statement  on  Auditing  Standards:  The  report  should  include  a  statement  that  the  audit 
was  made  in  accordance  with  generally  accepted  government  auditing  standards  and 
disclose  when  applicable  standards  were  not  followed. 

5.  Internal  Controls:  The  report  should  identify  the  significant  internal  controls  that  were 
assessed,  the  scope  of  the  auditor's  assessment  work,  and  any  significant  weaknesses 
found  during  the  audit. 

6.  Compliance  With  Laws  and  Regulations:  The  report  should  include  all  significant 
instances  of  noncompliance  and  abuse  and  all  indications  or  instances  of  illegal  acts  that 
could  result  in  criminal  prosecution  that  were  found  during  or  in  connection  with  the  audit. 

7.  Views  of  Responsible  Officials:  The  report  should  include  the  pertinent  views  of 
responsible  officials  of  the  organization,  program,  activity,  or  function  audited  concerning 
the  auditors'  findings,  conclusions,  and  recommendations,  and  what  corrective  action  is 
planned. 

8.  Noteworthy  Accomplishments:  The  report  should  include  a  description  of  any 
significant  noteworthy  accomplishments,  particularly  when  management  improvements  in 
one  area  may  be  applicable  elsewhere. 

9.  Issues  Needing  Further  Study:  The  report  should  include  a  listing  of  any  significant 
issues  needing  further  study  and  consideration. 

10.  Privileged  and  Confidential  Information:  The  report  should  include  a  statement  about 
any  pertinent  information  that  was  omitted  because  it  is  deemed  privileged  or  confidential. 
The  nature  of  such  information  should  be  described,  and  the  basis  under  which  it  is 
withheld  should  be  stated. 

D.  Report  Presentation:  The  report  should  be  complete,  accurate,  objective,  and  convincing, 
and  be  as  clear  and  concise  as  the  subject  matter  permits. 

E.  Report  Distribution.  Written  audit  reports  are  to  be  submitted  by  the  audit  organization  to 
the  appropriate  officials  of  the  organization  audited,  and  to  the  appropriate  officials  of  the 
organizations  requiring  or  arranging  for  the  audits,  including  external  funding  organizations, 
unless  legal  restrictions,  ethical  considerations,  or  other  arrangements  prevent  it.  Copies  of 
the  reports  should  also  be  sent  to  other  officials  who  may  be  responsible  for  taking  action  on 
audit  findings  and  recommendations  and  to  others  authorized  to  receive  such  reports. 
Unless  restricted  by  law  or  regulation,  copies  should  be  made  available  for  public 
inspection. 

Vila.  AICPA  Generally  Accepted  Auditing  Standards 

A.  General  Standards 

1  The  examination  is  to  be  performed  by  a  person  or  persons  having  adequate  technical 
training  and  proficiency  as  an  auditor. 

(continued) 
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2.  In  all  matters  relating  to  the  assignment,  an  independence  in  mental  attitude  is  to  be 
maintained  by  the  auditor  or  auditors. 

3.  Due  professional  care  is  to  be  exercised  in  the  performance  of  the  examination  and  the 
preparation  of  the  report. 

B.  Standards  of  Field  Work 

1 .  The  work  is  to  be  adequately  planned  and  assistants,  if  any,  are  to  be  properly 
supervised. 

2.  A  sufficient  understanding  of  the  internal  control  structure  is  to  be  obtained  to  plan  the 
audit  and  to  determine  the  nature,  timing,  and  extent  of  tests  to  be  performed. 

3.  Sufficient  competent  evidential  matter  is  to  be  obtained  through  inspection, 
observation,  inquiries,  and  confirmations  to  afford  a  reasonable  basis  for  an  opinion 
regarding  the  financial  statements  under  examination. 

C.  Standards  of  Reporting 

1.  The  report  shall  state  whether  the  financial  statements  are  presented  in  accordance 
with  generally  accepted  accounting  principles. 

2.  The  report  shall  identify  those  circumstances  in  which  such  principles  have  not  been 
consistently  observed  in  the  current  period  in  relation  to  the  preceding  period. 

3.  Informative  disclosures  in  the  financial  statements  are  to  be  regarded  as  reasonably 
adequate  unless  otherwise  stated  in  the  report. 

4.  The  report  shall  either  contain  an  expression  of  opinion  regarding  the  financial 
statements,  taken  as  a  whole,  or  an  assertion  to  the  effect  that  an  opinion  cannot  be 
expressed.  When  an  overall  opinion  cannot  be  expressed,  the  reasons  therefor  should  be 
stated.  In  all  cases  where  an  auditor's  name  is  associated  with  financial  statements,  the 
report  should  contain  a  clear-cut  indication  of  the  character  of  the  auditor's  examination,  if 
any,  and  the  degree  of  responsibility  he  is  taking. 
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GENERALLY  ACCEPTED  GOVERNMENT  AUDITING  STANDARDS  (GAGAS) 


GENERALLY  ACCEPTED  GOVERNMENT 
AUDITING  STANDARDS  (GAGAS) 


TYPES  OF 
AUDITS 


GENERAL 

STANDARDS 


FINANCIAL     PERFORMANCE      QUALIFICATIONS 


INDEPENDENCE     DUE  PROFESSIONAL 
CARE 


QUALITY 
CONTROL 


•  Financial  •  Economy  and  •  Proficiency 
Statement  Efficiency  •  Continuing 

•  Financial  •  Program                   Professional 
Related                                            Education 


Impairments 

•  External 
Impairments 

•  Organizational 
Independence 


•  Planning 

•  Conducting 

•  Reporting 


•  Internal 

•  External 
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GENERALLY  ACCEPTED  GOVERNMENT  AUDITING  STANDARDS  (GAGAS)  (Continued) 


FIELD  WORK 

REPORTING 

FIELD  WORK 

REPORTING 

STANDARDS 

STANDARDS 

STANDARDS 

STANDARDS 

•  Planning  and 

•  Compliance  with 

0 
1 

•  Planning 

•  Form 

Supervision 

GAAP 

•  Supervision 

•  Timeliness 

•  Internal  Controls 

•  Consistency 

•  Compliance 

•  Contents 

•  Evidential  Matter 

•  Disclosures 

•  Internal  Controls 

•  Presentation 

•  Planning 

•  Opinions 

•  Evidence 

•  Distribution 

-Audit  Needs 

•  Auditing  Standards 

—  Compliance 

•  Compliance 

•  Evidence 

•  Internal  Controls 
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—  Working  Papers 
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•  Internal  Controls 
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Confidential 

§ 
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Abuse 


Furnishing  excessive  services  to  beneficiaries;  or 
performing  what  may  be  considered  improper  prac- 
tices, none  of  which  involves  noncompliance  with 
laws  and  regulations. 


Audit 


Refers  to  the  type  of  work  described  in  chapter  2  of 
this  statement. 


Audit  Methodology 


The  methods  and  techniques  used  to  gather  and 
analyze  data  needed  to  accomplish  the  audit 
objectives. 


Audit  Objective(s) 


A  statement  of  the  purpose  of  the  audit;  the  ques- 
tion(s)  the  audit  will  answer.  (Note:  The  aicpa  refers 
to  audit  objectives  as  the  objectives  developed  to 
achieve  the  financial  statement  assertions.) 


Audit  Program 


A  document  listing  the  suggested  steps  and  proce- 
dures to  be  followed  in  conducting  the  audit  and 
preparing  the  report. 


Audit  Results 


Include  the  audit  findings,  and  as  appropriate,  con- 
clusions and  recommendations. 


Audit  Scope 
Impairments 


Factors  external  to  the  audit  organization  which 
can  restrict  the  auditors'  ability  to  render  objective 
opinions  and  conclusions. 


Audit  Standards 


Pertain  to  the  auditor's  professional  qualifications, 
the  quality  of  audit  effort,  and  the  characteristics 
of  professional  and  meaningful  audit  reports. 


Auditor 


The  term  as  used  in  this  statement  refers  to  the 
auditor  as  well  as  the  audit  organization  unless 
otherwise  indicated  in  this  statement. 
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Auditor's  Opinion 


An  expression  in  the  audit  report  of  the  auditor's 
position  on  whether  the  financial  information  of  the 
entity  is  presented  fairly,  in  all  material  respects,  in 
conformity  with  generally  accepted  accounting 
principles  (or  with  other  specified  accounting  prin- 
ciples applicable  to  the  auditee). 


Body  of  Technical 
Knowledge 


Existing  sources  of  information  on  types  of  audits, 
tests,  procedures,  and  methodology.  Such  informa- 
tion is  available  through  such  organizations  as  the 
American  Evaluation  Association,  American  Insti- 
tute of  Certified  Public  Accountants,  Canadian 
Comprehensive  Auditing  Foundation,  Institute  of 
Internal  Auditors,  Intergovernmental  Audit 
Forums,  and  U.S.  General  Accounting  Office. 


Competence 


Refers  to  evidence  that  is  valid  and  reliable. 


Compliance  With 
Laws  and 
Regulations 


The  term,  as  used  in  this  statement,  refers  to  fol- 
lowing requirements  or  not  violating  prohibitions 
contained  in  statutes,  regulations,  contracts,  and 
grants  and  in  binding  policies  and  procedures  gov 
erning  entity  conduct. 


Computer-Based 
System 


That  part  of  an  overall  information  system  which 
uses  automated  equipment  and  associated  methods 
and  procedures  to  process  the  data  and  information. 


Computer-Processed 
Data 


Data  that  are  collected,  processed,  and  stored,  and 
subsequently  compiled  and  produced  as  data  or 
information,  through  use  of  a  computer. 


Conclusions 


An  expression  in  the  audit  report  of  the  auditor's 
position  on  the  audit  objective(s). 
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Contract  Audit 


An  audit  of  a  government  contract  for  goods  and 
services  with  profit  as  well  as  nonprofit 
organizations. 


Due  Professional 
Care 


The  third  general  standard  for  government  audit- 
ing. Conducting  audits  and  preparing  reports  in 
accordance  with  generally  accepted  government 
auditing  standards  including: 

•  Competently  and  adequately  carrying  out  the  audit 
steps  and  procedures  which  are  necessary  in  order 
to  achieve  the  audit  objectives. 

•  Possessing  skill  and  knowledge  appropriate  for  the 
audit. 

•  Using  sound  judgment  in  establishing  the  scope, 
selecting  the  methodology,  and  choosing  tests  and 
procedures  for  the  audit,  and  in  evaluating  and 
reporting  on  the  audit  results. 

•  Exercising  integrity  and  objectivity  in  conducting 
the  audit  and  preparing  the  report. 

•  Follow-up  on  known  findings  and  recommendations 
from  previous  audits  to  determine  whether  prompt 
and  appropriate  corrective  actions  have  been  taken 
by  entity  officials. 


Evidence 


The  data  and  information  an  auditor  obtains  during 
audit  field  work  to  document  findings  and  support 
opinions  and  conclusions. 


External 
Impairments 


These  are  factors  external  to  the  audit  organization 
that  may  restrict  the  audit  or  interfere  with  an 
auditor's  ability  to  form  independent  and  objective 
opinions  and  conclusions. 


External  Quality 
Control  Review 
Program 


A  review  of  an  audit  organization  by  an  organiza- 
tion not  affiliated  with  the  audit  organization  being 
reviewed  to  determine  that:  (1)  the  organization's 
internal  quality  control  system  is  in  place  and  oper- 
ating effectively  and  (2)  established  policies  and 
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procedures  and  applicable  auditing  standards  are 
being  followed  in  its  audit  work,  including  its  gov- 
ernment audits. 


Financial  Audits 


1 .  Financial  statement  audits  determine  (a)  whether 
the  financial  statements  of  an  audited  entity  pre- 
sent fairly  the  financial  position,  results  of  opera- 
tions, and  cash  flows  or  changes  in  financial 
position  in  accordance  with  generally  accepted 
accounting  principles,  and  (b)  whether  the  entity 
has  complied  with  laws  and  regulations  for  those 
transactions  and  events  that  may  have  a  material 
effect  on  the  financial  statements. 


2.  Financial  related  audits  include  determining 
(a)  whether  financial  reports  and  related  items, 
such  as  elements,  accounts,  or  funds  are  fairly  pre- 
sented, (b)  whether  financial  information  is  pre- 
sented in  accordance  with  established  or  stated 
criteria,  and  (c)  whether  the  entity  has  adhered  to 
specific  financial  compliance  requirements. 


Financial  Statements 


A  presentation  of  financial  data  and  information, 
including  accompanying  notes,  derived  from 
accounting  records  to  communicate  at  a  point  in 
time  an  entity's  financial  position,  and  for  a  period 
of  time  its  results  of  operations  and  cash  flows  or 
changes  in  financial  position. 


Findings 


The  result  of  information  development — a  logical 
pulling  together  of  information  to  arrive  at  conclu- 
sions (or  a  response  to  an  audit  objective  on  the 
basis  of  the  sum  of  the  information)  about  an  organ- 
ization, program,  activity,  function,  condition,  or 
other  matter  which  was  analyzed  or  evaluated.  It 
need  not  be  critical  or  be  concerned  only  with  defi- 
ciencies or  weaknesses.  A  finding  will  be  the  basis 
for  conclusions  and  recommendations  for  corrective 
action. 
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Generally  Accepted 
Accounting 
Principles  (GAAP) 


Rules  and  procedures  established  by  authoritative 
bodies  or  conventions  that  have  evolved  through 
custom  and  common  usage. 

The  Governmental  Accounting  Standards  Board 
(gasb)  establishes  accounting  principles  and  finan- 
cial reporting  standards  for  state  and  local  govern- 
ment entities. 

The  Financial  Accounting  Standards  Board  (fasb) 
establishes  accounting  principles  for  nongovern- 
ment entities. 


The  General  Accounting  Office  (gao)  establishes 
accounting  principles  and  financial  reporting  stan- 
dards for  the  federal  government. 

Some  state  and  local  governments  and  regulatory 
bodies  also  have  established  specific  accounting 
principles. 


Generally  Accepted 
Auditing  Standards 
(GAAS) 


Those  audit  standards  set  forth  in  the  aicpa's  State- 
ments on  Auditing  Standards. 


Generally  Accepted 
Government 
Auditing  Standards 
(GAGAS) 


Those  audit  standards  set  forth  in  the  (fevernment 
Auditing  Standards  (Standards  for  Audit  of  Gov- 
ernmental Organizations,  Programs,  Activities,  and 
Functions)  issued  by  the  Comptroller  General  of  the 
United  States. 


General  Standards 


A  term  pertaining  to  (1)  the  qualifications  of  the 
staff,  (2)  the  audit  organization's  and  the  individual 
auditor's  independence,  (3)  the  exercise  of  due  pro- 
fessional care  in  conducting  the  audit  and  in  prepar- 
ing related  reports,  and  (4)  the  presence  of  quality 
controls. 
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Government 
Activity 


A  specific  and  distinguishable  line  of  work  con- 
ducted within  an  organizational  component  of  a 
government  entity. 


Government  Entity        Generally  means  a: 


•  State  agency  (e.g.,  department,  office,  commission, 
committee,  division,  bureau,  or  section  within  state 
government.) 

•  Municipality  (i.e.,  a  city  or  town  with  its  own  incor- 
porated government  for  local  affairs). 

•  County,  independent  school  district,  special  district, 
or  authority. 

•  Local  agency  (e.g.,  department,  office,  commission, 
committee,  division,  bureau,  or  section  within  local 
government). 

•  Nonprofit  government  agency. 

•  Government  regional  planning  agency,  commission, 
authority,  or  corporation. 

•  Federal  department  and  agency. 


Government 
Function 


The  purpose  for  which  a  government  organization 
is  responsible. 


Government 
Organization 


A  government  entity  or  component  of  a  government 
entity. 


Government 
Program 


Generally  defined  as  an  organized  set  of  activities 
directed  toward  a  common  goal.  In  practice,  how- 
ever, the  term  program  has  many  uses  and  thus 
does  not  have  a  well-defined  meaning. 


Illegal  Acts 


A  type  of  noncompliance  in  which  the  source  of  the 
requirement  not  followed  or  prohibition  violated  is 
a  statute  or  implementing  regulation. 
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Independence 


The  second  general  standard  for  government  audit- 
ing. In  all  matters  relating  to  the  audit  work,  the 
audit  organization  and  the  individual  auditors, 
whether  government  or  public,  should  be  free  from 
personal  and  external  impairments  to  indepen- 
dence, should  be  organizationally  independent,  and 
should  maintain  an  independent  attitude  and 
appearance. 


Internal  Control 


Internal  control  is  defined  as  follows: 

1 .  According  to  the  aicpa,  sas  on  Consideration  of 
the  Internal  Control  Structure  in  a  Financial  State- 
ment Audit.  This  applies  to  the  field  work  and 
reporting  standards  for  financial  audits  contained 
in  chapters  4  and  5  of  this  statement. 

An  entity's  internal  control  structure  consists  of  the 
policies  and  procedures  established  to  provide  rea- 
sonable assurance  that  specific  entity  objectives 
will  be  achieved.  An  entity's  internal  control  struc- 
ture consists  of  three  elements: 

Control  Environment:  The  collective  effect  of  vari- 
ous factors  on  establishing,  enhancing,  or  mitigating 
the  effectiveness  of  specific  policies  and  procedures. 
Accounting  System:  The  methods  and  records  estab- 
lished to  identify,  assemble,  analyze,  classify, 
record,  and  report  an  entity's  transactions  and  to 
maintain  accountability  for  the  related  assets  and 
liabilities. 

Control  Procedures:  The  policies  and  procedures  in 
addition  to  the  control  environment  and  accounting 
system  that  management  has  established  to  provide 
reasonable  assurance  that  specific  entity  objectives 
will  be  achieved. 

2.  According  to  the  gao's  Standards  for  Internal 
Controls  in  the  Federal  Government:  This  applies  to 
the  field  work  and  reporting  standards  for  perfor- 
mance audits  contained  in  chapters  6  and  7  of  this 
statement. 
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"The  plan  of  organization  and  methods  and  procedures 
adopted  by  management  to  ensure  that  resource  use  is  consis- 
tent with  laws,  regulations,  and  policies;  that  resources  are 
safeguarded  against  waste,  loss,  and  misuse;  and  that  reliable 
data  are  obtained,  maintained,  and  fairly  disclosed  in 
reports." 


Internal  Quality 
Control  System 


Operating  policies  and  procedures  established  by 
the  audit  organization  to  provide  reasonable  assur- 
ance that  it:  (1)  has  established,  and  is  following, 
adequate  audit  policies  and  procedures  and  (2)  has 
adopted,  and  is  following,  applicable  auditing 
standards. 


Materiality  and/or 
Significance 


The  weight  that  evidence  plays  in  influencing  the 
auditor's  decision  concerning:  the  selection  of  issues 
and  areas  for  audit;  the  nature,  timing,  and  extent 
of  audit  tests  and  procedures  (methodology);  and 
the  auditor's  audit  opinion,  judgment,  or  conclusion. 


Materiality:  The  magnitude  of  an  omission  or  mis- 
statement of  accounting  information  that,  in  the 
light  of  surrounding  circumstances,  makes  it  proba- 
ble that  the  judgment  of  a  reasonable  person  relying 
on  the  information  would  have  been  changed  or 
influenced  by  the  omission  or  misstatement.  Materi- 
ality judgments  are  made  in  light  of  surrounding 
circumstances  and  necessarily  involve  both  quanti- 
tative and  qualitative  considerations. 
Significance:  The  importance,  in  relation  to  the 
audit  objectives,  of  an  item,  event,  information,  or 
matter,  or  of  a  problem  the  auditor  identifies. 


Noncompliance  With 
Laws  and 
Regulations 


A  failure  to  follow  requirements,  or  a  violation  of 
prohibitions,  contained  in  statutes,  regulations,  con- 
tracts, grants,  and  binding  policies  and  procedures 
governing  entity  conduct. 
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Organizational 
Independence 


This  concerns  the  auditor's  being  sufficiently 
removed  from  pressures  within  the  organizational 
structure  of  a  government  to  express  impartial 
opinions  and  conclusions. 


Performance  Audits 


1.  Economy  and  efficiency  audits  include  determin- 
ing (a)  whether  the  entity  is  acquiring,  protecting, 
and  using  its  resources  (such  as  personnel,  prop- 
erty, and  space)  economically  and  efficiently, 

(b)  the  causes  of  inefficiencies  or  uneconomical 
practices,  and  (c)  whether  the  entity  has  complied 
with  laws  and  regulations  concerning  matters  of 
economy  and  efficiency. 

2.  Program  audits  include  deterrnining  (a)  the 
extent  to  which  the  desired  results  or  benefits 
established  by  the  legislature  or  other  authorizing 
body  are  being  achieved,  (b)  the  effectiveness  of 
organizations,  programs,  activities,  or  functions, 
and  (c)  whether  the  entity  is  complying  with 
requirements  of  laws  and  regulations  applicable  to 
the  program. 


Personal 
Impairments 


They  involve  circumstances  in  which  auditors  may 
not  be  impartial,  or  may  not  be  perceived  to  be 
impartial. 


Planning 


The  first  field  work  standard  for  government  audit- 
ing. This  standard  requires  that  the  work  is  to  be 
adequately  planned.  Adequate  planning  includes 
consideration  of:  audit  objectives,  scope,  and  meth- 
odology; criteria  for  assessing  performance  (where 
applicable);  coordination  with  other  government 
auditors;  skill  and  knowledge  of  the  staff  to  be 
used,  and  the  use  of  consultants,  experts,  and  spe- 
cialists; compliance  with  laws  and  regulations  and 
potential  abuse  and  illegal  acts;  assessment  of  inter- 
nal controls;  and  materiality  and/or  significance 
and  audit  risk. 


Page  6-9 


Glossary 


Program 

Effectiveness 

Evaluation 


The  application  of  systematic  methods  to  estimate 
the  extent  to  which  observed  results,  intended  or 
unintended,  are  caused  by  program  activities.  Cause 
is  linked  to  effect  through  use  of  design  and  analy- 
sis methods  which  compare  results  observed  after 
implementation  to  estimates  of  results  which  would 
have  been  observed  in  the  absence  of  the  program. 


The  application  of  systematic  methods  to  the 
assessment  of  program  conceptualization,  imple- 
mentation, and  effectiveness. 


Program  Evaluation 


Qualifications 


The  first  general  standard  for  government  auditing. 
The  staff  assigned  should  collectively  possess  (1)  a 
knowledge  of  the  methods  and  techniques  applica- 
ble to  government  auditing  and  be  able  to  apply  it, 
(2)  a  knowledge  of  government  organizations,  pro- 
grams, activities,  and  functions,  (3)  the  skills  to 
communicate  clearly  and  effectively,  and  (4)  the 
knowledge  and  the  skills  necessary  for  the  audit. 


Qualifications  of 
Public  Accountants 


When  public  accountants  are  engaged  to  conduct 
financial  audits  that  lead  to  an  expression  of  an 
opinion,  public  accountants  should  be:  (1)  licensed 
certified  public  accountants  or  persons  working  for 
a  licensed  certified  public  accounting  firm  or 
(2)  public  accountants  licensed  on  or  before  Decem- 
ber 31, 1970,  or  persons  working  for  a  public 
accounting  firm  licensed  on  or  before  December  31, 
1970. 


Quality  Control 


The  fourth  general  standard  for  government  audit- 
ing. Audit  organizations  conducting  government 
audits  should  have  an  appropriate  internal  quality 
control  system  in  place  and  participate  in  an  exter- 
nal quality  control  review  program. 
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Recommendations 


Actions  the  auditor  believes  are  needed  to  correct 
problem  areas  and  to  improve  operations. 


Relevance 


Refers  to  the  relationship  of  evidence  to  its  use. 


Report  (Audit) 


1.  The  auditor's  report  in  a  financial  audit  through 
which  an  auditor  expresses  a  conclusion  or  opinion 
or,  if  circumstances  require,  disclaims  an  opinion. 

2.  The  auditor's  report  in  a  performance  audit 
through  which  an  auditor  communicates  the  audit 
results. 

3.  Other  special  auditor's  reports  through  which  an 
auditor  communicates  information  required  by  the 
audit  engagement  include  "Report  on  Compliance," 
"Report  on  Internal  Control,"  and  so  forth. 


Scope 


Refers  to  the  depth  and  coverage  of  audit  work.  It 
concerns  such  questions  as:  Is  the  whole  program  or 
a  part  going  to  be  audited?  What  period  of  time  is  to 
be  covered?  Is  the  audit  regional  or  confined  to  par- 
ticular localities?  How  precise  must  measures  of 
performance  be?  What  level  of  validity  is  needed  in 
documenting  the  existence  of  a  problem?  What  find- 
ing and  reporting  elements  are  to  be  developed? 


Should 


When  the  term  "should"  is  used  to  describe  the 
auditor's  and/or  audit  organization's  responsibility, 
this  means  that  the  standards  that  are  applicable  to 
the  work  and  necessary  to  satisfy  the  audit  objec- 
tives are  to  be  followed.  Departures  from  applicable 
standards  must  be  disclosed  in  the  audit  report. 


Significance 


See  materiality. 
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Sufficiency 


The  presence  of  enough  factual  and  convincing  evi- 
dence to  support  the  auditors  findings,  conclusions, 
and  any  recommendations. 


Supervision 


This  standard  for  government  auditing  requires 
that  staff  be  properly  supervised.  Supervisors 
should  ensure  that  less  skilled  staff  members 
receive  training  and  guidance  in  doing  their  work 
and  that  all  staff  clearly  understand  their  tasks  and 
what  the  work  is  expected  to  accomplish. 


Survey 


A  process  for  quickly  gathering  information,  with- 
out detailed  verification,  on  the  entity's  organiza- 
tion, programs,  activities,  and  functions.  It  is  an 
effective  method  to  help  identify  specific  audit 
areas  and  to  obtain  information  for  use  in  planning. 


Timeliness 


This  standard  for  government  auditing  states  that 
reports  are  to  be  issued  promptly  so  as  to  make  the 
information  available  for  timely  use  by  manage- 
ment and  legislative  officials,  and  by  other  inter- 
ested parties. 


Value-For-Money 
Audits 


Audits  which  assess  whether  government  entities 
are  managed  with  regard  for  economy  and  effi- 
ciency, and  for  effectiveness  measurement,  and  in 
compliance  with  applicable  laws,  regulations,  and 
directives. 


Working  Papers 


Documents  containing  the  evidence  to  support  the 
auditor's  findings,  opinions,  conclusions,  and  judg- 
ments. They  include  the  collection  of  evidence,  pre- 
pared or  obtained  by  the  auditor  during  the  audit. 
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